systime-fix: Unregister validator also if time got valid

This avoids accepting expired certificates again should the time get
rolled back for some reason.

Fixes: c81b87ac265e ("systime-fix: Add timeout option to stop waiting for valid system time")
Fixes: 295e42a47f9a ("systime-fix disables certificate lifetime validation if system time not synced")

diff --git a/src/libcharon/plugins/systime_fix/systime_fix_plugin.c b/src/libcharon/plugins/systime_fix/systime_fix_plugin.c
index 878ccb851aeaee1f4b09ec53e876dbdb5edf0709..56ac329d43cd708f4d8f71a9ed8c04f6f8d903cb 100644 (file)
--- a/src/libcharon/plugins/systime_fix/systime_fix_plugin.c
+++ b/src/libcharon/plugins/systime_fix/systime_fix_plugin.c
@@ -158,14 +158,14 @@ static job_requeue_t check_systime(private_systime_fix_plugin_t *this)
                }
                DBG1(DBG_CFG, "timeout reached while waiting for valid system time, "
                         "force rechecking certificates");
-               /* force regular lifetime checks for new connections */
-               lib->credmgr->remove_validator(lib->credmgr,
-                                                                          &this->validator->validator);
        }
        else
        {
                DBG1(DBG_CFG, "system time got valid, rechecking certificates");
        }
+       /* force regular lifetime checks for new connections */
+       lib->credmgr->remove_validator(lib->credmgr,
+                                                                  &this->validator->validator);
 
        enumerator = charon->ike_sa_manager->create_enumerator(
                                                                                                charon->ike_sa_manager, TRUE);