ike: Do not send initial contact only for UNIQUE_NEVER

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>

diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c
index 628ea0de878deb2903cf6d4b7c1b7d2b1bab362a..4c16adba3dfaf6e29de5a17aa18998d95835fdf5 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/main_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/main_mode.c
@@ -221,8 +221,7 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
        idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
        if (idr && !idr->contains_wildcards(idr))
        {
-               if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
-                       this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
+               if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
                {
                        host = this->ike_sa->get_other_host(this->ike_sa);
                        if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager,

diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c
index 53daaf2ad5a30d684a3beedb5fa875fa2667b18a..aeaa701c9a0ffe8795e50bc977425780d2c5fc69 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_auth.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c
@@ -471,7 +471,6 @@ METHOD(task_t, build_i, status_t,
 
                if (idr && !idr->contains_wildcards(idr) &&
                        message->get_message_id(message) == 1 &&
-                       this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
                        this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
                {
                        host_t *host;

diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index ac0c2dd5820ec9a1bd838b51884049bcf736b972..e5dbc921cb7679ed7fe44196c98eae01cc3f3db6 100644 (file)
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -216,7 +216,7 @@ connections.<conn>.unique = no
        On initiators this setting specifies whether an INITIAL_CONTACT notify is
        sent during IKE_AUTH if no existing connection is found with the remote
        peer (determined by the identities of the first authentication round).
-       Only if set to _keep_ or _replace_ will the client send a notify.
+       Unless set to _never_ the client will send a notify.
 
 connections.<conn>.reauth_time = 0s
        Time to schedule IKE reauthentication.