From 1201ddcbc5dda4849524f08a0923071d1b15b387 Mon Sep 17 00:00:00 2001 From: Thomas Egerer Date: Thu, 9 Oct 2014 11:15:07 +0200 Subject: ikev1: Don't inherit children if INITITAL_CONTACT was seen Signed-off-by: Thomas Egerer --- src/libcharon/sa/ike_sa_manager.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c index bdabc59b5..144cd7d3f 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -1783,7 +1783,10 @@ static status_t enforce_replace(private_ike_sa_manager_t *this, if (is_ikev1_reauth(duplicate, host)) { /* looks like a reauthentication attempt */ - adopt_children(duplicate, new); + if (!new->has_condition(new, COND_INIT_CONTACT_SEEN)) + { + adopt_children(duplicate, new); + } /* For IKEv1 we have to delay the delete for the old IKE_SA. Some * peers need to complete the new SA first, otherwise the quick modes * might get lost. */ -- cgit v1.2.3