]> git.ipfire.org Git - thirdparty/strongswan.git/commit
Merge branch 'reqid-refcount'
authorTobias Brunner <tobias@strongswan.org>
Mon, 13 Nov 2023 11:02:25 +0000 (12:02 +0100)
committerTobias Brunner <tobias@strongswan.org>
Mon, 13 Nov 2023 11:02:25 +0000 (12:02 +0100)
commited2d548fee7f786f0dcf79191bba008ec09f2e7f
tree59d07f934cff4c188e5078c9420fbbb8791a847c
parent04c17ab56a6a00a60cf2ac0becbbc29a7eff22bb
parent00d054aae53c2835d50241f981c265b0bba9c29e
Merge branch 'reqid-refcount'

This fixes issues with CHILD_SAs getting reestablished concurrently.
We intend to reuse the reqid of the previous CHILD_SA, however, previously
the reqids were released and up for reassignment to any other CHILD_SA
or trap policy.  This could cause the reqid to get associated with
completely different traffic selectors, as the reestablished CHILD_SA
would eventually get the requested reqid because the traffic selectors
explicitly don't have to match (to allow narrowing for CHILD_SAs based
on trap policies).

Closes strongswan/strongswan#1855