mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
0e0116b957
When the rekey initiator's msg1 send failed, the cycle was abandoned cleanly and retried when rekey next came due, but every failure was recorded as the reject that means the remote sent something invalid. A send refused because the interface under the transport is absent or mid-rebind is a local, self-clearing condition, so an interface flap was still charged to the peer. A transient refusal is now logged at debug and not counted; a terminal one is still warned and counted. Tests drive the rekey check against an established peer on an Ethernet transport bound to an absent interface and on a transport that was never started. No wire format change.