ikev1: Don't inherit children if INITITAL_CONTACT was seen

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>

diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index bdabc59b5a9a4974faa6e52f0d2657b9cc3ac18e..144cd7d3f90c700c6509977324e4065743393145 100644 (file)
--- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c
@@ -1783,7 +1783,10 @@ static status_t enforce_replace(private_ike_sa_manager_t *this,
        if (is_ikev1_reauth(duplicate, host))
        {
                /* looks like a reauthentication attempt */
-               adopt_children(duplicate, new);
+               if (!new->has_condition(new, COND_INIT_CONTACT_SEEN))
+               {
+                       adopt_children(duplicate, new);
+               }
                /* For IKEv1 we have to delay the delete for the old IKE_SA. Some
                 * peers need to complete the new SA first, otherwise the quick modes
                 * might get lost. */