ikev1: Send NAT-D payloads after HASH payloads in Aggressive Mode requests

Some implementations seem to have problems if the third AM message
contains NAT-D payloads before the HASH payload.

Fixes #2314.

diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
index 50dab9e384a595fd23b2e798bc4d12c43bc4c76d..6d850aac05e2d47d2f8e26920d8ef73d957f792a 100644 (file)
--- a/src/libcharon/encoding/message.c
+++ b/src/libcharon/encoding/message.c
@@ -554,10 +554,10 @@ static payload_order_t aggressive_i_order[] = {
        {PLV1_CERTREQ,                                  0},
        {PLV1_NOTIFY,                                   0},
        {PLV1_VENDOR_ID,                                0},
+       {PLV1_HASH,                                             0},
        {PLV1_NAT_D,                                    0},
        {PLV1_NAT_D_DRAFT_00_03,                0},
        {PLV1_SIGNATURE,                                0},
-       {PLV1_HASH,                                             0},
        {PLV1_FRAGMENT,                                 0},
 };