implemented IKE_SA uniqueness using ipsec.conf uniqueids paramater

additionally supports a "keep" value to keep the old IKE_SA

src/charon/sa/ike_sa_manager.c

@@ -686,6 +686,44 @@ static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
 	charon->bus->set_sa(charon->bus, ike_sa);
 	return ike_sa;
 }
+	
+/**
+ * Implementation of ike_sa_manager_t.checkout_duplicate.
+ */
+static ike_sa_t* checkout_duplicate(private_ike_sa_manager_t *this,
+									ike_sa_t *ike_sa)
+{
+	enumerator_t *enumerator;
+	entry_t *entry;
+	ike_sa_t *duplicate = NULL;
+	identification_t *me, *other;
+	
+	me = ike_sa->get_my_id(ike_sa);
+	other = ike_sa->get_other_id(ike_sa);
+	
+	pthread_mutex_lock(&this->mutex);
+	enumerator = this->ike_sa_list->create_enumerator(this->ike_sa_list);
+	while (enumerator->enumerate(enumerator, &entry))
+	{
+		if (entry->ike_sa == ike_sa)
+		{	/* self is not a duplicate */
+			continue;
+		}
+		if (wait_for_entry(this, entry))
+		{
+			if (me->equals(me, entry->ike_sa->get_my_id(entry->ike_sa)) &&
+				other->equals(other, entry->ike_sa->get_other_id(entry->ike_sa)))
+			{
+				duplicate = entry->ike_sa;
+				entry->checked_out = TRUE;
+				break;
+			}
+		}
+	}
+	enumerator->destroy(enumerator);
+	pthread_mutex_unlock(&this->mutex);
+	return duplicate;
+}
 
 /**
  * enumerator cleanup function
@@ -916,6 +954,7 @@ ike_sa_manager_t *ike_sa_manager_create()
 	this->public.checkout_by_config = (ike_sa_t*(*)(ike_sa_manager_t*,peer_cfg_t*))checkout_by_config;
 	this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t,bool))checkout_by_id;
 	this->public.checkout_by_name = (ike_sa_t*(*)(ike_sa_manager_t*,char*,bool))checkout_by_name;
+	this->public.checkout_duplicate = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_t *ike_sa))checkout_duplicate;
 	this->public.create_enumerator = (enumerator_t*(*)(ike_sa_manager_t*))create_enumerator;
 	this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
 	this->public.checkin_and_destroy = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_destroy;

src/charon/sa/ike_sa_manager.h

@@ -102,6 +102,14 @@ struct ike_sa_manager_t {
 	ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
 								 	 peer_cfg_t *peer_cfg);
 	
+	/**
+	 * Check out a duplicate if ike_sa to do uniqueness tests.
+	 *
+	 * @param ike_sa			ike_sa to get a duplicate from
+	 * @return					checked out duplicate
+	 */
+	ike_sa_t* (*checkout_duplicate)(ike_sa_manager_t *this, ike_sa_t *ike_sa);
+	
 	/**
 	 * Check out an IKE_SA a unique ID.
 	 *

src/charon/sa/tasks/ike_auth.c

@@ -88,6 +88,68 @@ struct private_ike_auth_t {
 	bool peer_authenticated;
 };
 
+/**
+ * check uniqueness and delete duplicates
+ */
+static bool check_uniqueness(private_ike_auth_t *this)
+{
+	ike_sa_t *duplicate;
+	unique_policy_t policy;
+	status_t status = SUCCESS;
+	peer_cfg_t *peer_cfg;
+	bool cancel = FALSE;
+	
+	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+	policy = peer_cfg->get_unique_policy(peer_cfg);
+	if (policy == UNIQUE_NO)
+	{
+		return FALSE;
+	}
+	duplicate = charon->ike_sa_manager->checkout_duplicate(
+										charon->ike_sa_manager, this->ike_sa);
+	if (duplicate)
+	{
+		peer_cfg = duplicate->get_peer_cfg(duplicate);
+		if (peer_cfg &&
+			peer_cfg->equals(peer_cfg, this->ike_sa->get_peer_cfg(this->ike_sa)))
+		{
+			switch (duplicate->get_state(duplicate))
+			{
+				case IKE_ESTABLISHED:
+				case IKE_REKEYING:
+					switch (policy)
+					{
+						case UNIQUE_REPLACE:
+							DBG1(DBG_IKE, "deleting duplicate IKE_SA due "
+								 "uniqueness policy");
+							status = duplicate->delete(duplicate);
+							break;
+						case UNIQUE_KEEP:
+							DBG1(DBG_IKE, "cancelling IKE_SA setup due "
+								 "uniqueness policy");
+							cancel = TRUE;
+							break;
+						default:
+							break;
+					}
+					break;
+				default:
+					break;
+			}
+		}
+		if (status == DESTROY_ME)
+		{
+			charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
+														duplicate);
+		}
+		else
+		{
+			charon->ike_sa_manager->checkin(charon->ike_sa_manager, duplicate);
+		}
+	}
+	return cancel;
+}
+
 /**
  * build the AUTH payload
  */
@@ -576,6 +638,12 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 		return FAILED;
 	}
 	
+	if (check_uniqueness(this))
+	{
+		message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
+		return FAILED;
+	}
+	
 	/* use "traditional" authentication if we could authenticate peer */
 	if (this->peer_authenticated)
 	{