ike-auth: Don't send INITIAL_CONTACT if remote ID contains wildcards

Such an identity won't equal an actual peer's identity resulting in
sending an INITIAL_CONTACT notify even if there might be an existing
IKE_SA.

diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c
index 036910d0e961e14270cdbd6fef856fce59692b38..1e47144dc744944f6ed8a60bc7dd4deb5bb89753 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_auth.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c
@@ -466,7 +466,8 @@ METHOD(task_t, build_i, status_t,
                get_reserved_id_bytes(this, id_payload);
                message->add_payload(message, (payload_t*)id_payload);
 
-               if (idr && message->get_message_id(message) == 1 &&
+               if (idr && !idr->contains_wildcards(idr) &&
+                       message->get_message_id(message) == 1 &&
                        this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
                        this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
                {