As responder, enforce the same configuration while rekeying CHILD_SAs

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
index ad7324d..f0cb24a 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.c
+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
@@ -935,7 +935,7 @@ METHOD(task_t, build_r, status_t,
        }
 
        peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
-       if (peer_cfg && this->tsi && this->tsr)
+       if (!this->config && peer_cfg && this->tsi && this->tsr)
        {
                host_t *me, *other;
 
@@ -1196,6 +1196,13 @@ METHOD(child_create_t, get_child, child_sa_t*,
        return this->child_sa;
 }
 
+METHOD(child_create_t, set_config, void,
+       private_child_create_t *this, child_cfg_t *cfg)
+{
+       DESTROY_IF(this->config);
+       this->config = cfg;
+}
+
 METHOD(child_create_t, get_lower_nonce, chunk_t,
        private_child_create_t *this)
 {
@@ -1295,6 +1302,7 @@ child_create_t *child_create_create(ike_sa_t *ike_sa,
        INIT(this,
                .public = {
                        .get_child = _get_child,
+                       .set_config = _set_config,
                        .get_lower_nonce = _get_lower_nonce,
                        .use_reqid = _use_reqid,
                        .task = {

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.h b/src/libcharon/sa/ikev2/tasks/child_create.h
index 20f5294..d29ba3d 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.h
+++ b/src/libcharon/sa/ikev2/tasks/child_create.h
@@ -64,6 +64,13 @@ struct child_create_t {
         * @return                      child_sa
         */
        child_sa_t* (*get_child) (child_create_t *this);
+
+       /**
+        * Enforce a specific CHILD_SA config as responder.
+        *
+        * @param cfg           configuration to enforce, reference gets owned
+        */
+       void (*set_config)(child_create_t *this, child_cfg_t *cfg);
 };
 
 /**

diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c
index 17102b0..f8c2ed1 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c
+++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c
@@ -187,6 +187,7 @@ METHOD(task_t, process_r, status_t,
 METHOD(task_t, build_r, status_t,
        private_child_rekey_t *this, message_t *message)
 {
+       child_cfg_t *config;
        u_int32_t reqid;
 
        if (this->child_sa == NULL ||
@@ -200,6 +201,8 @@ METHOD(task_t, build_r, status_t,
        /* let the CHILD_CREATE task build the response */
        reqid = this->child_sa->get_reqid(this->child_sa);
        this->child_create->use_reqid(this->child_create, reqid);
+       config = this->child_sa->get_config(this->child_sa);
+       this->child_create->set_config(this->child_create, config->get_ref(config));
        this->child_create->task.build(&this->child_create->task, message);
 
        if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)