]> git.ipfire.org Git - thirdparty/strongswan.git/commit
controller: Always return SUCCESS when terminating IKE_SAs without callback
authorShmulik Ladkani <shmulik@metanetworks.com>
Mon, 2 Nov 2020 12:54:48 +0000 (14:54 +0200)
committerTobias Brunner <tobias@strongswan.org>
Wed, 4 Nov 2020 18:42:41 +0000 (19:42 +0100)
commit1607e538e9d2f631e737d2a2040153e4771f8e28
tree8f5b7861a1bcaacac30a1501817f006c133e1f56
parent70b0c730d08ce0b8ef988105fdc631a193986980
controller: Always return SUCCESS when terminating IKE_SAs without callback

If no callback is specified, terminate_ike_execute() is invoked without the
listener waiting on the IKE state change.

Now, if 'force' is false, then ike_sa->delete() just queues an
IKE_DELETE task, and returns SUCCESS - indicating successful task
manager initiation.

However, terminate_ike_execute() ignored this success and set the
status to FAILED.

This is not ideal, as it will be the overall return code of
terminate_ike(), although no failure did occur. This eventually leads
vici's "terminate" to return "Command failed: terminating SA failed",
as seen in this example:

    In [9]: list(session.terminate({'ike-id': 2960, 'timeout': -1}))
    ---------------------------------------------------------------------------
    CommandException                          Traceback (most recent call last)
    <ipython-input-9-5f95b5cea88f> in <module>()
    ----> 1 list(session.terminate({'ike-id': 2960, 'timeout': -1}))

    vici/session.pyc in streamed_request(self, command, event_stream_type, message)
        136                 raise CommandException(
        137                     "Command failed: {errmsg}".format(
    --> 138                         errmsg=command_response["errmsg"]
        139                     )
        140                 )

    CommandException: Command failed: terminating SA failed

If we consider both queueing the task and actually destroying the IKS_SA
a success, we can just always return SUCCESS if we don't have a
callback. There is also no need to explicitly set the status to FAILED
if a listener is waiting as that's the default anyway.

Co-authored-by: Tobias Brunner <tobias@strongswan.org>
Closes strongswan/strongswan#185.
src/libcharon/control/controller.c