ike: Do not send initial contact only for UNIQUE_NEVER
authorThomas Egerer <thomas.egerer@secunet.com>
Wed, 25 Oct 2017 08:45:02 +0000 (10:45 +0200)
committerTobias Brunner <tobias@strongswan.org>
Thu, 2 Nov 2017 09:17:24 +0000 (10:17 +0100)
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
src/libcharon/sa/ikev1/tasks/main_mode.c
src/libcharon/sa/ikev2/tasks/ike_auth.c
src/swanctl/swanctl.opt

index 628ea0d..4c16adb 100644 (file)
@@ -221,8 +221,7 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
        idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
        if (idr && !idr->contains_wildcards(idr))
        {
-               if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
-                       this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
+               if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
                {
                        host = this->ike_sa->get_other_host(this->ike_sa);
                        if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager,
index 53daaf2..aeaa701 100644 (file)
@@ -471,7 +471,6 @@ METHOD(task_t, build_i, status_t,
 
                if (idr && !idr->contains_wildcards(idr) &&
                        message->get_message_id(message) == 1 &&
-                       this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
                        this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
                {
                        host_t *host;
index ac0c2dd..e5dbc92 100644 (file)
@@ -216,7 +216,7 @@ connections.<conn>.unique = no
        On initiators this setting specifies whether an INITIAL_CONTACT notify is
        sent during IKE_AUTH if no existing connection is found with the remote
        peer (determined by the identities of the first authentication round).
-       Only if set to _keep_ or _replace_ will the client send a notify.
+       Unless set to _never_ the client will send a notify.
 
 connections.<conn>.reauth_time = 0s
        Time to schedule IKE reauthentication.