denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike: Do not send initial contact only for UNIQUE_NEVER

Browse Source 
Signed-off-by: Thomas Egerer <[email protected]>
This commit is contained in:
Thomas Egerer
2017-11-02 10:17:24 +01:00
committed by Tobias Brunner
parent 6ce7ae24a4
commit 2dad293647
3 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/main_mode.c
+1 -2
View File
@@ -221,8 +221,7 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE); idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
if (idr && !idr->contains_wildcards(idr)) if (idr && !idr->contains_wildcards(idr))
{ {
if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO && if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
{ {
host = this->ike_sa->get_other_host(this->ike_sa); host = this->ike_sa->get_other_host(this->ike_sa);
if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager, if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager,
src/libcharon/sa/ikev2/tasks/ike_auth.c
-1
View File
@@ -471,7 +471,6 @@ METHOD(task_t, build_i, status_t,
if (idr && !idr->contains_wildcards(idr) && if (idr && !idr->contains_wildcards(idr) &&
message->get_message_id(message) == 1 && message->get_message_id(message) == 1 &&
this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER) this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
{ {
host_t *host; host_t *host;
src/swanctl/swanctl.opt
+1 -1
View File
@@ -216,7 +216,7 @@ connections.<conn>.unique = no
On initiators this setting specifies whether an INITIAL_CONTACT notify is On initiators this setting specifies whether an INITIAL_CONTACT notify is
sent during IKE_AUTH if no existing connection is found with the remote sent during IKE_AUTH if no existing connection is found with the remote
peer (determined by the identities of the first authentication round). peer (determined by the identities of the first authentication round).
Only if set to _keep_ or _replace_ will the client send a notify. Unless set to _never_ the client will send a notify.
connections.<conn>.reauth_time = 0s connections.<conn>.reauth_time = 0s
Time to schedule IKE reauthentication. Time to schedule IKE reauthentication.