From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 3 Nov 2017 10:49:45 +0000 (+0100)
Subject: child-sa: No need to find reqid of existing trap policy
X-Git-Tag: 5.6.3dr1~47^2~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c9998e5fea26d1dbe2c2a632aee4ab23b0309d6b;p=thirdparty%2Fstrongswan.git

child-sa: No need to find reqid of existing trap policy

When initiating a trap policy we explicitly pass the reqid along.  I guess
the lookup was useful to get the same reqid if a trapped CHILD_SA is manually
initiated.  However, we now get the same reqid anyway if there is no
narrowing.  And if the traffic selectors do get narrowed the reqid will be
different but that shouldn't be a problem as that doesn't cause an issue with
any temporary SAs in the kernel (this is why we pass the reqid to the
triggered CHILD_SA, otherwise, no new acquire would get triggered for
traffic that doesn't match the wider trap policy).
---

diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
index a01ee9e4d4..3523d4820a 100644
--- a/src/libcharon/sa/child_sa.c
+++ b/src/libcharon/sa/child_sa.c
@@ -1754,7 +1754,7 @@ static host_t* get_proxy_addr(child_cfg_t *config, host_t *ike, bool local)
  * Described in header.
  */
 child_sa_t * child_sa_create(host_t *me, host_t* other,
-							 child_cfg_t *config, uint32_t rekey, bool encap,
+							 child_cfg_t *config, uint32_t reqid, bool encap,
 							 u_int mark_in, u_int mark_out)
 {
 	private_child_sa_t *this;
@@ -1865,21 +1865,15 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
 
 	if (!this->reqid)
 	{
-		/* reuse old reqid if we are rekeying an existing CHILD_SA. While the
-		 * reqid cache would find the same reqid for our selectors, this does
-		 * not work in a special case: If an SA is triggered by a trap policy,
-		 * but the negotiated SA gets narrowed, we still must reuse the same
-		 * reqid to successfully "trigger" the SA on the kernel level. Rekeying
-		 * such an SA requires an explicit reqid, as the cache currently knows
-		 * the original selectors only for that reqid. */
-		if (rekey)
-		{
-			this->reqid = rekey;
-		}
-		else
-		{
-			this->reqid = charon->traps->find_reqid(charon->traps, config);
-		}
+		/* reuse old reqid if we are rekeying an existing CHILD_SA and when
+		 * initiating a trap policy. While the reqid cache would find the same
+		 * reqid for our selectors, this does not work in a special case: If an
+		 * SA is triggered by a trap policy, but the negotiated TS get
+		 * narrowed, we still must reuse the same reqid to successfully
+		 * replace the temporary SA on the kernel level. Rekeying such an SA
+		 * requires an explicit reqid, as the cache currently knows the original
+		 * selectors only for that reqid. */
+		this->reqid = reqid;
 	}
 	else
 	{