child-create: Maintain reference to reqid while CHILD_SA is established

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
index 928264820971f13e4720af52e1181159e33edc1d..a40941e66859dca6eef01b3e3a065a9f74693162 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.c
+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
@@ -1925,7 +1925,16 @@ METHOD(task_t, process_i, status_t,
 METHOD(child_create_t, use_reqid, void,
        private_child_create_t *this, uint32_t reqid)
 {
-       this->child.reqid = reqid;
+       uint32_t existing_reqid = this->child.reqid;
+
+       if (!reqid || charon->kernel->ref_reqid(charon->kernel, reqid) == SUCCESS)
+       {
+               this->child.reqid = reqid;
+               if (existing_reqid)
+               {
+                       charon->kernel->release_reqid(charon->kernel, existing_reqid);
+               }
+       }
 }
 
 METHOD(child_create_t, use_marks, void,
@@ -2064,6 +2073,10 @@ METHOD(task_t, destroy, void,
        {
                DESTROY_IF(this->child_sa);
        }
+       if (this->child.reqid)
+       {
+               charon->kernel->release_reqid(charon->kernel, this->child.reqid);
+       }
        DESTROY_IF(this->packet_tsi);
        DESTROY_IF(this->packet_tsr);
        DESTROY_IF(this->proposal);

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.h b/src/libcharon/sa/ikev2/tasks/child_create.h
index 705b7e1169ebf2d721ed2ade912d002ca7cc4353..62de4c6862d088e7c78180dca8bc3a1dfca23c3c 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.h
+++ b/src/libcharon/sa/ikev2/tasks/child_create.h
@@ -49,6 +49,10 @@ struct child_create_t {
         * When this task is used for rekeying, the same reqid is used
         * for the new CHILD_SA.
         *
+        * This must only be called with dynamically allocated reqids (i.e. from
+        * kernel_interface_t::alloc_reqid()), the method takes a reference that's
+        * maintained for the lifetime of the task.
+        *
         * @param reqid         reqid to use
         */
        void (*use_reqid) (child_create_t *this, uint32_t reqid);