From: Martin Willi <martin@revosec.ch>
Date: Wed, 18 Sep 2013 12:11:40 +0000 (+0200)
Subject: ikev1: Accept reauthentication attempts with a keep unique policy from same host
X-Git-Tag: 5.1.1dr4~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d2e4dd75b7967a7f2c024a1b4c2c1c916ea036ba;p=thirdparty%2Fstrongswan.git

ikev1: Accept reauthentication attempts with a keep unique policy from same host

When we have a "keep" unique policy in place, we have to be less strict in
rejecting Main/Aggressive Modes to enforce it. If the host/port equals to
that of an existing ISAKMP SA, we assume it is a reauthentication attempt
and accept the new SA (to replace the old).
---

diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index 7366420966..7f165957b3 100644
--- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c
@@ -1765,6 +1765,15 @@ static void adopt_children(ike_sa_t *old, ike_sa_t *new)
 	enumerator->destroy(enumerator);
 }
 
+/**
+ * Check if the replaced IKE_SA might get reauthenticated from host
+ */
+static bool is_ikev1_reauth(ike_sa_t *duplicate, host_t *host)
+{
+	return duplicate->get_version(duplicate) == IKEV1 &&
+		   host->equals(host, duplicate->get_other_host(duplicate));
+}
+
 /**
  * Delete an existing IKE_SA due to a unique replace policy
  */
@@ -1774,8 +1783,7 @@ static status_t enforce_replace(private_ike_sa_manager_t *this,
 {
 	charon->bus->alert(charon->bus, ALERT_UNIQUE_REPLACE);
 
-	if (duplicate->get_version(duplicate) == IKEV1 &&
-		host->equals(host, duplicate->get_other_host(duplicate)))
+	if (is_ikev1_reauth(duplicate, host))
 	{
 		/* looks like a reauthentication attempt */
 		adopt_children(duplicate, new);
@@ -1846,10 +1854,13 @@ METHOD(ike_sa_manager_t, check_uniqueness, bool,
 													 other, other_host);
 							break;
 						case UNIQUE_KEEP:
-							cancel = TRUE;
-							/* we keep the first IKE_SA and delete all
-							 * other duplicates that might exist */
-							policy = UNIQUE_REPLACE;
+							if (!is_ikev1_reauth(duplicate, other_host))
+							{
+								cancel = TRUE;
+								/* we keep the first IKE_SA and delete all
+								 * other duplicates that might exist */
+								policy = UNIQUE_REPLACE;
+							}
 							break;
 						default:
 							break;