ikev2: Compare initiator flag again, partially reverts 17ec1c74de

We should ignore messages that have the flag set incorrectly.
This restores RFC compliance which was broken since the mentioned commit.
This commit is contained in:
Tobias Brunner 2015-08-19 16:47:45 +02:00
parent 47a340e1f7
commit 5fee79d854
2 changed files with 5 additions and 1 deletions

View File

@ -18,7 +18,7 @@
#include "ike_sa_id.h"
#include <stdio.h>
#include <encoding/payloads/ike_header.h>
typedef struct private_ike_sa_id_t private_ike_sa_id_t;
@ -90,6 +90,8 @@ METHOD(ike_sa_id_t, equals, bool,
return FALSE;
}
return this->ike_version == other->ike_version &&
(this->ike_version == IKEV1_MAJOR_VERSION ||
this->is_initiator_flag == other->is_initiator_flag) &&
this->initiator_spi == other->initiator_spi &&
this->responder_spi == other->responder_spi;
}

View File

@ -157,6 +157,8 @@ static bool entry_match_by_id(entry_t *entry, ike_sa_id_t *id)
}
if ((id->get_responder_spi(id) == 0 ||
entry->ike_sa_id->get_responder_spi(entry->ike_sa_id) == 0) &&
(id->get_ike_version(id) == IKEV1_MAJOR_VERSION ||
id->is_initiator(id) == entry->ike_sa_id->is_initiator(entry->ike_sa_id)) &&
id->get_initiator_spi(id) == entry->ike_sa_id->get_initiator_spi(entry->ike_sa_id))
{
/* this is TRUE for IKE_SAs that we initiated but have not yet received a response */