child-rekey: Don't destroy IKE_SA if initiating CHILD_SA rekeying failed

This could happen if the peer e.g. selects an invalid DH group or
responds multiple time with an INVALID_KE_PAYLAOD notify.

diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c
index f90056658fa5cdacb842ca019e66db102ba182ac..3ca29bca4849e4dae830944fc1383eecc079601a 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c
+++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c
@@ -213,7 +213,8 @@ METHOD(task_t, build_i, status_t,
                                                                           message) != NEED_MORE)
        {
                schedule_delayed_rekey(this);
-               return FAILED;
+               message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
+               return SUCCESS;
        }
        if (message->get_exchange_type(message) == CREATE_CHILD_SA)
        {