jobs: Don't execute rekey CHILD_SA job on passive IKE_SAs

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>

diff --git a/src/libcharon/processing/jobs/rekey_child_sa_job.c b/src/libcharon/processing/jobs/rekey_child_sa_job.c
index 8f17d39abc225f515ea89ba7419d60d6aa8fcf2a..057876b331dda0241a196aade6846cac8d045582 100644 (file)
--- a/src/libcharon/processing/jobs/rekey_child_sa_job.c
+++ b/src/libcharon/processing/jobs/rekey_child_sa_job.c
@@ -67,7 +67,10 @@ METHOD(job_t, execute, job_requeue_t,
        }
        else
        {
-               ike_sa->rekey_child_sa(ike_sa, this->protocol, this->spi);
+               if (ike_sa->get_state(ike_sa) != IKE_PASSIVE)
+               {
+                       ike_sa->rekey_child_sa(ike_sa, this->protocol, this->spi);
+               }
                charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
        }
        return JOB_REQUEUE_NONE;