ike-rekey: Respond with TEMPORARY_FAILURE if CHILD_SAs are currently rekeyed/deleted...

diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
index 89503fa86f438024170f07815c9416f69a81bd47..828e7396d6c2c6f918360f40496eebe90b4371a1 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
@@ -67,6 +67,11 @@ struct private_ike_rekey_t {
         * colliding task detected by the task manager
         */
        task_t *collision;
+
+       /**
+        * TRUE if rekeying can't be handled temporarily
+        */
+       bool failed_temporarily;
 };
 
 /**
@@ -186,6 +191,7 @@ METHOD(task_t, process_r, status_t,
        if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
        {
                DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
+               this->failed_temporarily = TRUE;
                return NEED_MORE;
        }
 
@@ -201,6 +207,7 @@ METHOD(task_t, process_r, status_t,
                                /* we do not allow rekeying while we have children in-progress */
                                DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
                                enumerator->destroy(enumerator);
+                               this->failed_temporarily = TRUE;
                                return NEED_MORE;
                        default:
                                break;
@@ -224,7 +231,7 @@ METHOD(task_t, process_r, status_t,
 METHOD(task_t, build_r, status_t,
        private_ike_rekey_t *this, message_t *message)
 {
-       if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
+       if (this->failed_temporarily)
        {
                message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty);
                return SUCCESS;