From 1a31fe5580e2e78b63eab16377dd81101b53316a Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Wed, 4 Mar 2015 11:16:00 +0100 Subject: [PATCH] ikev2: Don't adopt any CHILD_SA during make-before-break reauthentication While the comment is rather clear that we should not adopt live CHILD_SAs during reauthentication in IKEv2, the code does nonetheless. Add an additional version check to fix reauthentication if the reauth responder has a replace uniqueids policy. Fixes #871. --- src/libcharon/sa/ike_sa_manager.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c index 6d0a59800..d0cbd47ef 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -1755,7 +1755,8 @@ static status_t enforce_replace(private_ike_sa_manager_t *this, if (host->equals(host, duplicate->get_other_host(duplicate))) { /* looks like a reauthentication attempt */ - if (!new->has_condition(new, COND_INIT_CONTACT_SEEN)) + if (!new->has_condition(new, COND_INIT_CONTACT_SEEN) && + new->get_version(new) == IKEV1) { /* IKEv1 implicitly takes over children, IKEv2 recreates them * explicitly. */