denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike: Do remote address updates also when behind static NATs

Browse Source 
We assume that a responder is behind a static NAT (e.g. port forwarding)
and allow remote address updates in such situations.

The problem described in RFC 5996 is only an issue if the NAT mapping
can expire.
This commit is contained in:
Tobias Brunner
2014-10-13 15:20:17 +02:00
parent f8a565fbcc
commit 472156eea5
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.c
+7 -4
View File
@@ -936,11 +936,14 @@ METHOD(ike_sa_t, update_hosts, void,
update = TRUE;
}
if (!other->equals(other, this->other_host))
if (!other->equals(other, this->other_host) &&
(force || has_condition(this, COND_NAT_THERE)))
{
/* update others address if we are NOT NATed */
if ((has_condition(this, COND_NAT_THERE) &&
!has_condition(this, COND_NAT_HERE)) || force )
/* only update other's address if we are behind a static NAT,
* which we assume is the case if we are not initiator */
if (force ||
(!has_condition(this, COND_NAT_HERE) ||
!has_condition(this, COND_ORIGINAL_INITIATOR)))
{
set_other_host(this, other->clone(other));
update = TRUE;