addrblock: Narrow selectors when rekeying a CHILD_SA as original responder

If a the original responder narrows the selectors of its peer in addrblock,
the peer gets a subset of that selectors. However, once the original responder
initiates rekeying of that CHILD_SA, it sends the full selectors to the peer,
and then narrows the received selectors locally for the installation, only.

This is insufficient, as the peer ends up with wider selectors, sending traffic
that the original responder will reject to the stricter IPsec policy. So
additionally narrow the selectors when rekeying CHILD_SAs before sending the
TS list to the peer.

diff --git a/src/libcharon/plugins/addrblock/addrblock_narrow.c b/src/libcharon/plugins/addrblock/addrblock_narrow.c
index 97040aa342fb3935717de2257b8ea15c910b549a..3b3b72ff843b14319d62da74723530b554cc4c18 100644 (file)
--- a/src/libcharon/plugins/addrblock/addrblock_narrow.c
+++ b/src/libcharon/plugins/addrblock/addrblock_narrow.c
@@ -105,6 +105,7 @@ METHOD(listener_t, narrow, bool,
        switch (type)
        {
                case NARROW_RESPONDER:
+               case NARROW_INITIATOR_PRE_AUTH:
                case NARROW_INITIATOR_POST_AUTH:
                case NARROW_INITIATOR_POST_NOAUTH:
                        narrow_addrblock(this, ike_sa, remote);