Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes

diff --git a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c
index 8fa2d525edc501a638b3bdc50392c10b7ec505cc..1b6ccc55819935a8f0df8bd35c8aa63e82799ddd 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c
@@ -293,14 +293,6 @@ METHOD(task_t, build_i, status_t,
                        }
                        this->id_data = chunk_empty;
 
-                       if (charon->ike_sa_manager->check_uniqueness(charon->ike_sa_manager,
-                                                                                                                this->ike_sa, FALSE))
-                       {
-                               DBG1(DBG_IKE, "cancelling Aggressive Mode due to uniqueness "
-                                        "policy");
-                               return send_notify(this, AUTHENTICATION_FAILED);
-                       }
-
                        switch (this->method)
                        {
                                case AUTH_XAUTH_INIT_PSK:
@@ -314,6 +306,13 @@ METHOD(task_t, build_i, status_t,
                                        /* TODO-IKEv1: not yet */
                                        return FAILED;
                                default:
+                                       if (charon->ike_sa_manager->check_uniqueness(
+                                                               charon->ike_sa_manager, this->ike_sa, FALSE))
+                                       {
+                                               DBG1(DBG_IKE, "cancelling Aggressive Mode due to "
+                                                        "uniqueness policy");
+                                               return send_notify(this, AUTHENTICATION_FAILED);
+                                       }
                                        if (!establish(this))
                                        {
                                                return send_notify(this, AUTHENTICATION_FAILED);
@@ -466,14 +465,6 @@ METHOD(task_t, process_r, status_t,
                                return send_delete(this);
                        }
 
-                       if (charon->ike_sa_manager->check_uniqueness(charon->ike_sa_manager,
-                                                                                                                this->ike_sa, FALSE))
-                       {
-                               DBG1(DBG_IKE, "cancelling Aggressive Mode due to uniqueness "
-                                        "policy");
-                               return send_delete(this);
-                       }
-
                        switch (this->method)
                        {
                                case AUTH_XAUTH_INIT_PSK:
@@ -488,6 +479,13 @@ METHOD(task_t, process_r, status_t,
                                        /* TODO-IKEv1: not yet supported */
                                        return FAILED;
                                default:
+                                       if (charon->ike_sa_manager->check_uniqueness(
+                                                               charon->ike_sa_manager, this->ike_sa, FALSE))
+                                       {
+                                               DBG1(DBG_IKE, "cancelling Aggressive Mode due to "
+                                                        "uniqueness policy");
+                                               return send_delete(this);
+                                       }
                                        if (!establish(this))
                                        {
                                                return send_delete(this);

diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c
index 419c9d36d6462c828fe6fdedf6bb463403e85936..11bdc1d2afdeddafe46f67a3b1c8a3d1cb4a411d 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/main_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/main_mode.c
@@ -493,12 +493,6 @@ METHOD(task_t, build_r, status_t,
                        {
                                return send_notify(this, AUTHENTICATION_FAILED);
                        }
-                       if (charon->ike_sa_manager->check_uniqueness(charon->ike_sa_manager,
-                                                                                                                this->ike_sa, FALSE))
-                       {
-                               DBG1(DBG_IKE, "cancelling Main Mode due to uniqueness policy");
-                               return send_notify(this, AUTHENTICATION_FAILED);
-                       }
 
                        switch (this->method)
                        {
@@ -514,6 +508,13 @@ METHOD(task_t, build_r, status_t,
                                        /* TODO-IKEv1: not yet supported */
                                        return FAILED;
                                default:
+                                       if (charon->ike_sa_manager->check_uniqueness(
+                                                               charon->ike_sa_manager, this->ike_sa, FALSE))
+                                       {
+                                               DBG1(DBG_IKE, "cancelling Main Mode due to uniqueness "
+                                                        "policy");
+                                               return send_notify(this, AUTHENTICATION_FAILED);
+                                       }
                                        if (!establish(this))
                                        {
                                                return send_notify(this, AUTHENTICATION_FAILED);
@@ -622,12 +623,6 @@ METHOD(task_t, process_i, status_t,
                                         "cancelling");
                                return send_delete(this);
                        }
-                       if (charon->ike_sa_manager->check_uniqueness(charon->ike_sa_manager,
-                                                                                                                this->ike_sa, FALSE))
-                       {
-                               DBG1(DBG_IKE, "cancelling Main Mode due to uniqueness policy");
-                               return send_delete(this);
-                       }
 
                        switch (this->method)
                        {
@@ -642,6 +637,13 @@ METHOD(task_t, process_i, status_t,
                                        /* TODO-IKEv1: not yet */
                                        return FAILED;
                                default:
+                                       if (charon->ike_sa_manager->check_uniqueness(
+                                                               charon->ike_sa_manager, this->ike_sa, FALSE))
+                                       {
+                                               DBG1(DBG_IKE, "cancelling Main Mode due to uniqueness "
+                                                        "policy");
+                                               return send_delete(this);
+                                       }
                                        if (!establish(this))
                                        {
                                                return send_delete(this);