Currently racoon does not remove orphaned ph1s initiated
by a remote side. This creates a lot of problems, as
such ph1s may stuck nearly forever. With this patch
they will be eventually removed.
Index: src/racoon/handler.c
===================================================================
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.c,v
retrieving revision 1.19
diff -u -r1.19 handler.c
--- src/racoon/handler.c 6 Mar 2008 00:34:11 -0000 1.19
+++ src/racoon/handler.c 11 Aug 2008 22:56:21 -0000
@@ -266,6 +266,9 @@
iph1->status = PHASE1ST_SPAWN;
+ /* save created date. */
+ (void)time(&iph1->created);
+
#ifdef ENABLE_DPD
iph1->dpd_support = 0;
iph1->dpd_lastack = 0;
@@ -423,6 +426,44 @@
}
}
+/*
+ * Clean orphaned ph1
+ */
+void
+cleanorphanedph1()
+{
+ struct ph1handle *p, *next;
+ time_t t;
+
+ (void)time(&t);
+
+ for (p = LIST_FIRST(&ph1tree); p; p = next) {
+ next = LIST_NEXT(p, chain);
+
+ /* Ignore ph1 in ESTABLISHED state - not orphaned */
+ if (p->status == PHASE1ST_ESTABLISHED)
+ continue;
+
+ /* Check only ph1 initiated by a remote side */
+ if (p->side == INITIATOR)
+ continue;
+
+ /* Is it orphaned or not yet? */
+ if (p->created + PHASE1_ORPHANED_TIMEOUT > t)
+ continue;
+
+ plog(LLV_ERROR, LOCATION, NULL,
+ "phase1 negotiation failed due to time up. %s\n",
+ isakmp_pindex(&p->index, p->msgid));
+
+ EVT_PUSH(p->local, p->remote,
+ EVTT_PEER_NO_RESPONSE, NULL);
+
+ remph1(p);
+ delph1(p);
+ }
+}
+
void
initph1tree()
{
Index: src/racoon/handler.h
===================================================================
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.h,v
retrieving revision 1.14
diff -u -r1.14 handler.h
--- src/racoon/handler.h 14 Jul 2008 05:45:15 -0000 1.14
+++ src/racoon/handler.h 11 Aug 2008 22:56:21 -0000
@@ -97,6 +97,8 @@
#define PHASE1ST_EXPIRED 10
#define PHASE1ST_MAX 11
+#define PHASE1_ORPHANED_TIMEOUT (3*60)
+
/* About address semantics in each case.
* initiator(addr=I) responder(addr=R)
* src dst src dst
@@ -190,7 +192,7 @@
struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */
- time_t created; /* timestamp for establish */
+ time_t created; /* timestamp: first for spawn then for establish */
int initial_contact_received; /* set if initial contact received */
#ifdef ENABLE_STATS
struct timeval start;
@@ -449,6 +451,7 @@
extern int insph1 __P((struct ph1handle *));
extern void remph1 __P((struct ph1handle *));
extern void flushph1 __P((void));
+extern void cleanorphanedph1 __P((void));
extern void initph1tree __P((void));
extern struct ph2handle *getph2byspidx __P((struct policyindex *));
Index: src/racoon/session.c
===================================================================
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/session.c,v
retrieving revision 1.15
diff -u -r1.15 session.c
--- src/racoon/session.c 6 Aug 2008 19:14:28 -0000 1.15
+++ src/racoon/session.c 11 Aug 2008 22:56:22 -0000
@@ -236,6 +236,8 @@
else
initfds();
}
+
+ cleanorphanedph1();
}
}
|
