sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-06 00:00:47 -04:00
Code Issues Projects Releases Wiki Activity

unity: Handle narrowing according to roles in the IKE_SA

Browse Source 
Since the narrow hook types reflect the roles in the Quick Mode exchange
the plugin behaved incorrectly if the server initiated the CHILD_SA
rekeying.
This commit is contained in:
Tobias Brunner 2014-07-17 17:24:43 +02:00 committed by Martin Willi
parent cb98380fe9
commit a45ba880c8
1 changed files with 33 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
src/libcharon/plugins/unity/unity_narrow.c
View File

@ -146,23 +146,40 @@ METHOD(listener_t, narrow, bool,
if (ike_sa->get_version(ike_sa) == IKEV1 &&
ike_sa->supports_extension(ike_sa, EXT_CISCO_UNITY))
{
switch (type)
/* depending on who initiates a rekeying the hooks will not match the
* roles in the IKE_SA */
if (ike_sa->has_condition(ike_sa, COND_ORIGINAL_INITIATOR))
{
case NARROW_INITIATOR_PRE_AUTH:
narrow_pre(remote, "other");
break;
case NARROW_INITIATOR_POST_AUTH:
narrow_initiator(this, ike_sa,
child_sa->get_config(child_sa), remote);
break;
case NARROW_RESPONDER:
narrow_pre(local, "us");
break;
case NARROW_RESPONDER_POST:
narrow_responder_post(child_sa->get_config(child_sa), local);
break;
default:
break;
switch (type)
{
case NARROW_INITIATOR_PRE_AUTH:
case NARROW_RESPONDER:
narrow_pre(remote, "other");
break;
case NARROW_INITIATOR_POST_AUTH:
case NARROW_RESPONDER_POST:
narrow_initiator(this, ike_sa,
child_sa->get_config(child_sa), remote);
break;
default:
break;
}
}
else
{
switch (type)
{
case NARROW_INITIATOR_PRE_AUTH:
case NARROW_RESPONDER:
narrow_pre(local, "us");
break;
case NARROW_INITIATOR_POST_AUTH:
case NARROW_RESPONDER_POST:
narrow_responder_post(child_sa->get_config(child_sa), local);
break;
default:
break;
}
}
}
return TRUE;