Robert Moskowitz wrote:
Hi,
I was playing with my firewall rules and decided to stop hipfw and
hipd on the server, restart them, then try gftp again.
I did not cycle HIP on the client, only the server. Thus the client
still had an SA for the server.
Regular stream of ESP packets. At no point was there evidence of a
timeout behavour and a new HIP exchange; I had to recycle HIP on the
client.
killing hipd causes it to send CLOSE to its active peers which
deletes security associations at the peer. As you know, the userspace
ipsec is a bleeding edge feature and it was missing support for
deletion of SAs. This feature is available on a development branch,
which I can merge as soon as I have tested the branch.
