From 9bc0d3095a112d1d0f15793c2f82c31ed604c774 Mon Sep 17 00:00:00 2001 From: VANHULLEBUS Yvan Date: Mon, 23 Mar 2009 20:37:37 +0000 Subject: SAs are valid (but dying) when they reached soft lifetime, even if they have never been used. Approved by: gnn(mentor) --- sys/netipsec/key.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) (limited to 'sys') diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index dbe7b59f9bdf..45625e200c0d 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -4109,22 +4109,20 @@ key_flush_sad(time_t now) /* check SOFT lifetime */ if (sav->lft_s->addtime != 0 && now - sav->created > sav->lft_s->addtime) { - /* - * check SA to be used whether or not. - * when SA hasn't been used, delete it. + key_sa_chgstate(sav, SADB_SASTATE_DYING); + /* + * Actually, only send expire message if + * SA has been used, as it was done before, + * but should we always send such message, + * and let IKE daemon decide if it should be + * renegotiated or not ? + * XXX expire message will actually NOT be + * sent if SA is only used after soft + * lifetime has been reached, see below + * (DYING state) */ - if (sav->lft_c->usetime == 0) { - key_sa_chgstate(sav, SADB_SASTATE_DEAD); - KEY_FREESAV(&sav); - } else { - key_sa_chgstate(sav, SADB_SASTATE_DYING); - /* - * XXX If we keep to send expire - * message in the status of - * DYING. Do remove below code. - */ + if (sav->lft_c->usetime != 0) key_expire(sav); - } } /* check SOFT lifetime by bytes */ /* -- cgit v1.3