child-create: Don't create CHILD_SA if the IKE_SA got redirected in IKE_AUTH

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
index 740d09778f935990304d3232c8f9dd222df22076..3d4ded944718a9409eca340d9a2c9d417f4b9270 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.c
+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
@@ -1220,6 +1220,10 @@ METHOD(task_t, build_r, status_t,
                        {       /* wait until all authentication round completed */
                                return NEED_MORE;
                        }
+                       if (this->ike_sa->has_condition(this->ike_sa, COND_REDIRECTED))
+                       {       /* no CHILD_SA is created for redirected SAs */
+                               return SUCCESS;
+                       }
                        ike_auth = TRUE;
                default:
                        break;