ikev1: Reestablish SAs if reauthentication failed due to retransmits

diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
index 7fe6d112bcb2e2e6ce6e69d42bdf3cb5f3b84c12..7f272a95bb44da3e8a0a46bc166f438594157b37 100644 (file)
--- a/src/libcharon/sa/ike_sa.c
+++ b/src/libcharon/sa/ike_sa.c
@@ -2347,6 +2347,15 @@ METHOD(ike_sa_t, retransmit, status_t,
                                        return this->task_manager->initiate(this->task_manager);
                                }
                                DBG1(DBG_IKE, "establishing IKE_SA failed, peer not responding");
+
+                               if (this->version == IKEV1 && array_count(this->child_sas))
+                               {
+                                       /* if reauthenticating an IKEv1 SA failed (assumed for an SA
+                                        * in this state with CHILD_SAs), try again from scratch */
+                                       DBG1(DBG_IKE, "reauthentication failed, trying to "
+                                                "reestablish IKE_SA");
+                                       reestablish(this);
+                               }
                                break;
                        }
                        case IKE_DELETING: