diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2014-04-15 16:00:47 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2014-04-15 16:19:06 +0200 |
| commit | 4469e3d0507ad869488d3e7524a061e18fb3ee21 (patch) | |
| tree | 8295cf515c2be9013bc131291c3fba0de8bc53b1 /src/libcharon/sa/ikev2/tasks/child_create.c | |
| parent | 37cb91d737808c7fa710fb276d2d3136155829db (diff) | |
| download | strongswan-4469e3d0507ad869488d3e7524a061e18fb3ee21.tar.bz2 strongswan-4469e3d0507ad869488d3e7524a061e18fb3ee21.tar.xz | |
ikev2: Fix reauthentication if peer assigns a different virtual IP
Before this change a reqid set on the create_child_t task was used as
indicator of the CHILD_SA being rekeyed. Only if that was not the case
would the local traffic selector be changed to 0.0.0.0/0|::/0 (as we
don't know which virtual IP the gateway will eventually assign).
On the other hand, in case of a rekeying the VIP is expected to remain
the same, so the local TS would simply equal the VIP.
Since c949a4d5016e33c5 reauthenticated CHILD_SAs also have the reqid
set. Which meant that the local TS would contain the previously
assigned VIP, basically rendering the gateway unable to assign a
different VIP to the client as the resulting TS would not match
the client's proposal anymore.
Fixes #553.
Diffstat (limited to 'src/libcharon/sa/ikev2/tasks/child_create.c')
| -rw-r--r-- | src/libcharon/sa/ikev2/tasks/child_create.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index df7bc96d6..e0ade07b2 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -950,7 +950,7 @@ METHOD(task_t, build_i, status_t, /* check if we want a virtual IP, but don't have one */ list = linked_list_create(); peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); - if (!this->reqid) + if (!this->rekey) { enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg); while (enumerator->enumerate(enumerator, &vip)) |