sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-05 00:00:45 -04:00
Code Issues Projects Releases Wiki Activity

unity: Do not bump TS to 0.0.0.0/0 as initiator when no Split-Include received

Browse Source 
When having the unity plugin enabled and both peers send the Unity Vendor ID,
we proposed 0.0.0.0/0 as traffic selector, even if no Split-Include has been
received on the SA. This can break compatibility with some responders, as
they don't narrow the TS themselves, but expect the configured TS.
This commit is contained in:
Martin Willi 2014-08-04 10:38:08 +02:00
parent a45ba880c8
commit cfdc620a3f
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/libcharon/plugins/unity/unity_narrow.c
View File

@ -139,6 +139,23 @@ static void narrow_responder_post(child_cfg_t *child_cfg, linked_list_t *local)
configured->destroy(configured);
}
/**
* Check if any Split-Include attributes are active on this IKE_SA
*/
static bool has_split_includes(private_unity_narrow_t *this, ike_sa_t *ike_sa)
{
enumerator_t *enumerator;
traffic_selector_t *ts;
bool has;
enumerator = this->handler->create_include_enumerator(this->handler,
ike_sa->get_unique_id(ike_sa));
has = enumerator->enumerate(enumerator, &ts);
enumerator->destroy(enumerator);
return has;
}
METHOD(listener_t, narrow, bool,
private_unity_narrow_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
narrow_hook_t type, linked_list_t *local, linked_list_t *remote)
@ -154,7 +171,10 @@ METHOD(listener_t, narrow, bool,
{
case NARROW_INITIATOR_PRE_AUTH:
case NARROW_RESPONDER:
narrow_pre(remote, "other");
if (has_split_includes(this, ike_sa))
{
narrow_pre(remote, "other");
}
break;
case NARROW_INITIATOR_POST_AUTH:
case NARROW_RESPONDER_POST: