ike: Fall back to the current remote IP if it resolves to %any

In some situations it might be valid for a host that configures
right=%any to reestablish or reauthenticate an IKE_SA. Using %any would
immediately abort the initiation causing the new SA to fail (which
might already have the existing CHILD_SAs assigned).

Fixes #1027.
This commit is contained in:
Tobias Brunner
2015-07-27 13:45:16 +02:00
parent f22c655b11
commit 6f7a3b33bc
+6 -1
View File
@@ -1224,7 +1224,12 @@ static void resolve_hosts(private_ike_sa_t *this)
}
if (host)
{
set_other_host(this, host);
if (!host->is_anyaddr(host) ||
this->other_host->is_anyaddr(this->other_host))
{ /* don't set to %any if we currently have an address, but the
* address family might have changed */
set_other_host(this, host);
}
}
if (this->local_host)