strongSwan

06.12.2018

09:09 strongSwan Bug #2847: Duplicate CHILD_SA in case of poor network connectivity and make-before-break reauthentication

After one night, I confirm that the problem is gone.
Thank you very much !

05.12.2018

16:48 strongSwan Bug #2847: Duplicate CHILD_SA in case of poor network connectivity and make-before-break reauthentication

The test is running since 1 hour now. No duplicate found. \o/
I let the test run all the night. I'll confirm the f...

13:57 strongSwan Bug #2847: Duplicate CHILD_SA in case of poor network connectivity and make-before-break reauthentication

Tobias Brunner wrote:
> If the peer supports IKEv2 fragmentation, use that and maybe reduce the fragment size. You s...

10:54 strongSwan Bug #2847: Duplicate CHILD_SA in case of poor network connectivity and make-before-break reauthentication

Sorry for the late response, your questions made me rethink the problem. I was focused on a duplicate of CHILD_SA, bu...

03.12.2018

16:48 strongSwan Bug #2847: Duplicate CHILD_SA in case of poor network connectivity and make-before-break reauthentication

Tobias Brunner wrote:
> > - And now, here start the strange things. Charon mark the rekeying IPSEC SA as rekeyed, an...

14:59 strongSwan Bug #2837: IKE_SA is inadvertently reset when a delayed COOKIE payload is received with the same value already in use

Tobias Brunner wrote:
> > For the retransmitted IKE_SA_INIT message, I confirm that your fix works properly.
>
> ...

14:58 strongSwan Bug #2847 (Closed): Duplicate CHILD_SA in case of poor network connectivity and make-before-break reauthentication

Hi,
I'm currently trying to reproduce an issue when CHILD_SA are rekey with a poor internet connectivity (packets ...

29.11.2018

16:15 strongSwan Bug #2837: IKE_SA is inadvertently reset when a delayed COOKIE payload is received with the same value already in use

For the retransmitted IKE_SA_INIT message, I confirm that your fix works properly.
For the SAs, I confirm that the...

11:57 strongSwan Bug #2837: IKE_SA is inadvertently reset when a delayed COOKIE payload is received with the same value already in use

Tobias Brunner wrote:
> > > Hm, but that would mean it is still associated with an active IKE_SA. But which byte cou...

10:59 strongSwan Bug #2837: IKE_SA is inadvertently reset when a delayed COOKIE payload is received with the same value already in use

Tobias Brunner wrote:
>
> Not really dead, the COOKIE notify just triggered a reset of the IKE_SA (usually when a ...