denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Don't adopt any CHILD_SA during make-before-break reauthentication

Browse Source 
While the comment is rather clear that we should not adopt live CHILD_SAs
during reauthentication in IKEv2, the code does nonetheless. Add an additional
version check to fix reauthentication if the reauth responder has a replace
uniqueids policy.

Fixes #871.
This commit is contained in:
Martin Willi
2015-03-04 11:18:42 +01:00
parent 436cdae840
commit 1a31fe5580
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.c
+2 -1
View File
@@ -1755,7 +1755,8 @@ static status_t enforce_replace(private_ike_sa_manager_t *this,
if (host->equals(host, duplicate->get_other_host(duplicate))) if (host->equals(host, duplicate->get_other_host(duplicate)))
{ {
/* looks like a reauthentication attempt */ /* looks like a reauthentication attempt */
if (!new->has_condition(new, COND_INIT_CONTACT_SEEN)) if (!new->has_condition(new, COND_INIT_CONTACT_SEEN) &&
new->get_version(new) == IKEV1)
{ {
/* IKEv1 implicitly takes over children, IKEv2 recreates them /* IKEv1 implicitly takes over children, IKEv2 recreates them
* explicitly. */ * explicitly. */