From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 21 Feb 2018 09:58:39 +0000 (+0100)
Subject: child-sa: Don't try to update outbound SA if it is not installed anymore
X-Git-Tag: 5.6.3dr1~46
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ca79bd54ffe693f4737760bbfb74e94d4c4898a5;p=thirdparty%2Fstrongswan.git

child-sa: Don't try to update outbound SA if it is not installed anymore
---

diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
index 3523d4820a..b7833109a3 100644
--- a/src/libcharon/sa/child_sa.c
+++ b/src/libcharon/sa/child_sa.c
@@ -1463,7 +1463,7 @@ static status_t update_sas(private_child_sa_t *this, host_t *me, host_t *other,
 	}
 
 	/* update his (responder) SA */
-	if (this->other_spi)
+	if (this->other_spi && (this->outbound_state & CHILD_OUTBOUND_SA))
 	{
 		kernel_ipsec_sa_id_t id = {
 			.src = this->my_addr,