Skip to content

Commit

Permalink
Delete the modecfg retransmit on phase2 start
Browse files Browse the repository at this point in the history
Previously, even once we got the response from the tablet, we kept
retransmitting the modecfg response... which meant that within a minute
or two we'd run out of retransmits and terminate the connection.

This is due how the timers work at the phase1 → phase2 transition. Work
around it well enough for now.

Find a better fix once we upgrade to a newer Libreswan.

Internal ticket [TABLET-1418].
  • Loading branch information
derobert committed Jul 13, 2020
1 parent 16cf7b7 commit 6d66bf4
Showing 1 changed file with 18 additions and 0 deletions.
18 changes: 18 additions & 0 deletions programs/pluto/ikev1_quick.c
Original file line number Diff line number Diff line change
Expand Up @@ -1370,6 +1370,24 @@ static stf_status quick_inI1_outR1_authtail(struct verify_oppo_bundle *b)
(hv.st_nat_traversal & NAT_T_WITH_NATOA))
nat_traversal_natoa_lookup(md, &hv);

if (p1st->st_event && EVENT_v1_RETRANSMIT == p1st->st_event->ev_type) {
/* KLUGE: To work around the tablet nots retransmitting their
* ModeCfg IP request, enabled retransmits on
* STATE_MODE_CFG_R0. However, after that retransmit...
* we get forcefully transitioned to STATE_QUICK_R0 and
* suspend the phase1, so the retransmit timer never gets
* cleared. So we clear it here. Otherwise it'll keep
* retransmitting, time out, and fairly soon down the
* connection.
*
* FIXME: But nothing sets back the EVENT_SA_REPLACE timer...
* which is normally done in ikev1.c:2467 ("case
* EVENT_SA_REPLACE:"). Not sure how much it matters,
* since the p2 state gets that event too.
*/
delete_event(p1st);
}

/* now that we are sure of our connection, create our new state */
{
struct state *const st = duplicate_state(p1st, IPSEC_SA);
Expand Down

0 comments on commit 6d66bf4

Please sign in to comment.