ikev1: Make sure proposed IPsec mode matches our own

References #557.

diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
index 0d6be38812b70708ffca0618f1c4654534b247a2..1133aab65b63f479ace48b7b77717440091d4f86 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
@@ -1030,7 +1030,8 @@ METHOD(task_t, process_r, status_t,
                        }
                        tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
                        tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
-                       if (!this->config || !this->tsi || !this->tsr)
+                       if (!this->config || !this->tsi || !this->tsr ||
+                               this->mode != this->config->get_mode(this->config))
                        {
                                DBG1(DBG_IKE, "no matching CHILD_SA config found");
                                return send_notify(this, INVALID_ID_INFORMATION);