<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#f4f6f6">
Hi Tobias,<br>
<br>
in fact, I see a bit different behaviour. Having the following code:<br>
<pre> t = v.terminate({
'ike-id': ike_id,
'timeout': 5000
})
try:
for c in t:
pass
except Exception as e:
print(e)
</pre>
nothing happens to IKE_SA if I omit "for c in t" statement -
Strongswan don't report in the log "12[CFG] vici terminate IKE_SA
#nnn" and don't start processing, regardless of timeout and force
parameters.<br>
<br>
Processing starts only upon iterating of "t". This is every-time
reproduceable behaviour.<br>
<br>
<div class="moz-cite-prefix">On 03.12.2019 13:39, Tobias Brunner
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:657eab7c-f6b1-e908-029c-2342331a65f5@strongswan.org">
<pre class="moz-quote-pre" wrap="">Hi Volodymyr,
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">thanks a lot, it works. It worth to say, that timeout must be set to
reasonable value to allow Strongswan to finish the task. If set to -1 or
few milliseconds, it returns failure as well :)
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
If you are referring to the returned error "terminating SA failed",
that's because with -1 (or a short timeout) the code doesn't wait until
the termination is fully completed (a regular termination causes DELETEs
to be sent and until the peer either replies, or there is a timeout
after several retransmits, it is not complete). So you get that error
because VICI doesn't know if the SA was actually terminated. The
termination is still initiated unless you receive the error "no matching
SAs to terminate found", it just happens in the background.
If you don't want to wait and send retransmits for DELETEs, use the
"force" option, optionally combined with a timeout, so the code waits
for a reply to the DELETEs for a while and then destroys the SA even if
none was received.
Regards,
Tobias
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Volodymyr Litovka
"Vision without Execution is Hallucination." -- Thomas Edison</pre>
</body>
</html>