ike: Fall back to the current remote IP if it resolves to %any
In some situations it might be valid for a host that configures right=%any to reestablish or reauthenticate an IKE_SA. Using %any would immediately abort the initiation causing the new SA to fail (which might already have the existing CHILD_SAs assigned). Fixes #1027.
This commit is contained in:
@@ -1224,7 +1224,12 @@ static void resolve_hosts(private_ike_sa_t *this)
|
||||
}
|
||||
if (host)
|
||||
{
|
||||
set_other_host(this, host);
|
||||
if (!host->is_anyaddr(host) ||
|
||||
this->other_host->is_anyaddr(this->other_host))
|
||||
{ /* don't set to %any if we currently have an address, but the
|
||||
* address family might have changed */
|
||||
set_other_host(this, host);
|
||||
}
|
||||
}
|
||||
|
||||
if (this->local_host)
|
||||
|
||||
Reference in New Issue
Block a user