/* if we are retrying after an INVALID_KE_PAYLOAD we already have one */
if (!this->dh)
{
- if (this->old_sa)
+ if (this->old_sa && lib->settings->get_bool(lib->settings,
+ "%s.prefer_previous_dh_group", TRUE, lib->ns))
{ /* reuse the DH group we used for the old IKE_SA when rekeying */
proposal_t *proposal;
uint16_t dh_group;
lib->settings->set_bool(lib->settings, "%s.prefer_configured_proposals",
TRUE, lib->ns);
+ lib->settings->set_bool(lib->settings, "%s.prefer_previous_dh_group",
+ FALSE, lib->ns);
initiate_rekey(a);
lib->settings->set_bool(lib->settings, "%s.prefer_configured_proposals",
TRUE, lib->ns);
+ lib->settings->set_bool(lib->settings, "%s.prefer_previous_dh_group",
+ FALSE, lib->ns);
/* Six nonces and SPIs are needed (SPI 1 and 2 are used for the initial
* IKE_SA):
lib->settings->set_bool(lib->settings, "%s.prefer_configured_proposals",
TRUE, lib->ns);
+ lib->settings->set_bool(lib->settings, "%s.prefer_previous_dh_group",
+ FALSE, lib->ns);
/* Five nonces and SPIs are needed (SPI 1 and 2 are used for the initial
* IKE_SA):