ikev2: Only request reauth during IKE_AUTH if active reauth is not possible

If we can initiate the reauthentication ourselves, there is no reason to
explicitly request the peer to do so (at basically the same time).

src/libcharon/sa/ike_sa.c

@@ -1937,6 +1937,23 @@ METHOD(ike_sa_t, rekey, status_t,
 	return this->task_manager->initiate(this->task_manager);
 }
 
+/*
+ * Described in header
+ */
+bool ike_sa_can_reauthenticate(ike_sa_t *public)
+{
+	private_ike_sa_t *this = (private_ike_sa_t*)public;
+
+	return array_count(this->other_vips) == 0 &&
+		   !has_condition(this, COND_XAUTH_AUTHENTICATED) &&
+		   !has_condition(this, COND_EAP_AUTHENTICATED)
+#ifdef ME
+			/* as mediation server we too cannot reauth the IKE_SA */
+			&& !this->is_mediation_server
+#endif /* ME */
+			;
+}
+
 METHOD(ike_sa_t, reauth, status_t,
 	private_ike_sa_t *this)
 {
@@ -1954,37 +1971,20 @@ METHOD(ike_sa_t, reauth, status_t,
 	/* we can't reauthenticate as responder when we use EAP or virtual IPs.
 	 * If the peer does not support RFC4478, there is no way to keep the
 	 * IKE_SA up. */
-	if (!has_condition(this, COND_ORIGINAL_INITIATOR))
+	if (!has_condition(this, COND_ORIGINAL_INITIATOR) &&
+		!ike_sa_can_reauthenticate(&this->public))
 	{
-		DBG1(DBG_IKE, "initiator did not reauthenticate as requested");
-		if (array_count(this->other_vips) != 0 ||
-			has_condition(this, COND_XAUTH_AUTHENTICATED) ||
-			has_condition(this, COND_EAP_AUTHENTICATED)
-#ifdef ME
-			/* as mediation server we too cannot reauth the IKE_SA */
-			|| this->is_mediation_server
-#endif /* ME */
-			)
-		{
-			time_t del, now;
+		time_t del, now;
 
-			del = this->stats[STAT_DELETE];
-			now = time_monotonic(NULL);
-			DBG1(DBG_IKE, "IKE_SA %s[%d] will timeout in %V",
-				 get_name(this), this->unique_id, &now, &del);
-			return FAILED;
-		}
-		else
-		{
-			DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d] actively",
-				 get_name(this), this->unique_id);
-		}
-	}
-	else
-	{
-		DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d]",
-			 get_name(this), this->unique_id);
+		del = this->stats[STAT_DELETE];
+		now = time_monotonic(NULL);
+		DBG1(DBG_IKE, "initiator did not reauthenticate as requested, IKE_SA "
+			 "%s[%d] will timeout in %V", get_name(this), this->unique_id,
+			 &now, &del);
+		return FAILED;
 	}
+	DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d]",
+		 get_name(this), this->unique_id);
 	set_condition(this, COND_REAUTHENTICATING, TRUE);
 	this->task_manager->queue_ike_reauth(this->task_manager);
 	return this->task_manager->initiate(this->task_manager);

src/libcharon/sa/ike_sa.h

@@ -1243,4 +1243,12 @@ struct ike_sa_t {
 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator,
 						ike_version_t version);
 
+/**
+ * Check if the given IKE_SA can be reauthenticated actively or if config
+ * parameters or the authentication method prevent it.
+ *
+ * @return				TRUE if active reauthentication is possible
+ */
+bool ike_sa_can_reauthenticate(ike_sa_t *this);
+
 #endif /** IKE_SA_H_ @}*/

src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.c

@@ -103,7 +103,10 @@ METHOD(task_t, build_r, status_t,
 	if (message->get_exchange_type(message) == IKE_AUTH &&
 		this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
 	{
-		add_auth_lifetime(this, message);
+		if (!ike_sa_can_reauthenticate(this->ike_sa))
+		{
+			add_auth_lifetime(this, message);
+		}
 		return SUCCESS;
 	}
 	return NEED_MORE;