diff options
| author | Martin Willi <martin@revosec.ch> | 2012-06-08 10:35:02 +0200 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2012-06-08 10:35:02 +0200 |
| commit | 82ad53b776972782c39c2c49fe7cc040bd56f56f (patch) | |
| tree | 8b52d5776a909606ba37024b7065d18cecf1bc87 /src | |
| parent | 2d4c347af9ffe408ba252b1fa3b6c16583a4715c (diff) | |
| download | strongswan-82ad53b776972782c39c2c49fe7cc040bd56f56f.tar.bz2 strongswan-82ad53b776972782c39c2c49fe7cc040bd56f56f.tar.xz | |
Try to rekey without KE exchange if peer returns INVALID_KE_PAYLOAD(NONE)
According to RFC5996, implementations should just ignore the KE payload
if they select a non-PFS proposals. Some implementations don't, but
return MODP_NONE in INVALID_KE_PAYLOAD, hence we accept that, too.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/sa/ikev2/tasks/child_create.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index f0cb24a72..1148eba7d 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -171,6 +171,11 @@ struct private_child_create_t { * whether the CHILD_SA rekeys an existing one */ bool rekey; + + /** + * whether we are retrying with another DH group + */ + bool retry; }; /** @@ -725,7 +730,7 @@ METHOD(task_t, build_i, status_t, message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty); return SUCCESS; } - if (this->dh_group == MODP_NONE) + if (!this->retry) { this->dh_group = this->config->get_dh_group(this->config); } @@ -1112,6 +1117,7 @@ METHOD(task_t, process_i, status_t, DBG1(DBG_IKE, "peer didn't accept DH group %N, " "it requested %N", diffie_hellman_group_names, this->dh_group, diffie_hellman_group_names, group); + this->retry = TRUE; this->dh_group = group; this->public.task.migrate(&this->public.task, this->ike_sa); enumerator->destroy(enumerator); @@ -1322,6 +1328,7 @@ child_create_t *child_create_create(ike_sa_t *ike_sa, .ipcomp = IPCOMP_NONE, .ipcomp_received = IPCOMP_NONE, .rekey = rekey, + .retry = FALSE, ); if (config) |