From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 14 Nov 2016 14:39:17 +0000 (+0100)
Subject: ike-auth: Don't send INITIAL_CONTACT if remote ID contains wildcards
X-Git-Tag: 5.5.2dr5~35
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2f95c55271fdfbe5ecf1648cc33e885bdd09db9e;p=thirdparty%2Fstrongswan.git

ike-auth: Don't send INITIAL_CONTACT if remote ID contains wildcards

Such an identity won't equal an actual peer's identity resulting in
sending an INITIAL_CONTACT notify even if there might be an existing
IKE_SA.
---

diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c
index 036910d0e9..1e47144dc7 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_auth.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c
@@ -466,7 +466,8 @@ METHOD(task_t, build_i, status_t,
 		get_reserved_id_bytes(this, id_payload);
 		message->add_payload(message, (payload_t*)id_payload);
 
-		if (idr && message->get_message_id(message) == 1 &&
+		if (idr && !idr->contains_wildcards(idr) &&
+			message->get_message_id(message) == 1 &&
 			this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
 			this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
 		{