diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2014-10-10 12:55:39 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2014-10-13 15:20:17 +0200 |
| commit | 472156eea5ce67d9769ed2f3f9ff24e48460d4e9 (patch) | |
| tree | fc0c06382df34fafcbc4d3325de56bd4e31b024e /src | |
| parent | f8a565fbccbe077583f556d2148041d3b1de5580 (diff) | |
| download | strongswan-472156eea5ce67d9769ed2f3f9ff24e48460d4e9.tar.bz2 strongswan-472156eea5ce67d9769ed2f3f9ff24e48460d4e9.tar.xz | |
ike: Do remote address updates also when behind static NATs
We assume that a responder is behind a static NAT (e.g. port forwarding)
and allow remote address updates in such situations.
The problem described in RFC 5996 is only an issue if the NAT mapping
can expire.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/sa/ike_sa.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index 0d4aa0cc1..d92b9df8e 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -936,11 +936,14 @@ METHOD(ike_sa_t, update_hosts, void, update = TRUE; } - if (!other->equals(other, this->other_host)) + if (!other->equals(other, this->other_host) && + (force || has_condition(this, COND_NAT_THERE))) { - /* update others address if we are NOT NATed */ - if ((has_condition(this, COND_NAT_THERE) && - !has_condition(this, COND_NAT_HERE)) || force ) + /* only update other's address if we are behind a static NAT, + * which we assume is the case if we are not initiator */ + if (force || + (!has_condition(this, COND_NAT_HERE) || + !has_condition(this, COND_ORIGINAL_INITIATOR))) { set_other_host(this, other->clone(other)); update = TRUE; |