sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-15 00:00:16 -04:00
Code Issues Projects Releases Wiki Activity

unity: Handle narrowing according to roles in the IKE_SA

Browse Source 
Since the narrow hook types reflect the roles in the Quick Mode exchange
the plugin behaved incorrectly if the server initiated the CHILD_SA
rekeying.
This commit is contained in:
Tobias Brunner 2014-07-17 17:24:43 +02:00 committed by Martin Willi
parent cb98380fe9
commit a45ba880c8
1 changed files with 33 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/libcharon/plugins/unity/unity_narrow.c
View File

@ -145,19 +145,35 @@ METHOD(listener_t, narrow, bool,
{ {
if (ike_sa->get_version(ike_sa) == IKEV1 && if (ike_sa->get_version(ike_sa) == IKEV1 &&
ike_sa->supports_extension(ike_sa, EXT_CISCO_UNITY)) ike_sa->supports_extension(ike_sa, EXT_CISCO_UNITY))
{
/* depending on who initiates a rekeying the hooks will not match the
* roles in the IKE_SA */
if (ike_sa->has_condition(ike_sa, COND_ORIGINAL_INITIATOR))
{ {
switch (type) switch (type)
{ {
case NARROW_INITIATOR_PRE_AUTH: case NARROW_INITIATOR_PRE_AUTH:
case NARROW_RESPONDER:
narrow_pre(remote, "other"); narrow_pre(remote, "other");
break; break;
case NARROW_INITIATOR_POST_AUTH: case NARROW_INITIATOR_POST_AUTH:
case NARROW_RESPONDER_POST:
narrow_initiator(this, ike_sa, narrow_initiator(this, ike_sa,
child_sa->get_config(child_sa), remote); child_sa->get_config(child_sa), remote);
break; break;
default:
break;
}
}
else
{
switch (type)
{
case NARROW_INITIATOR_PRE_AUTH:
case NARROW_RESPONDER: case NARROW_RESPONDER:
narrow_pre(local, "us"); narrow_pre(local, "us");
break; break;
case NARROW_INITIATOR_POST_AUTH:
case NARROW_RESPONDER_POST: case NARROW_RESPONDER_POST:
narrow_responder_post(child_sa->get_config(child_sa), local); narrow_responder_post(child_sa->get_config(child_sa), local);
break; break;
@ -165,6 +181,7 @@ METHOD(listener_t, narrow, bool,
break; break;
} }
} }
}
return TRUE; return TRUE;
} }