Block XAuth transaction on established IKE_SAs, but allow Mode Config

diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
index 7f5acccc0b84d7fcfa8758d29eb1264b010e2ef0..0a7c52a748dd6a21a0f844c743225988fd7e78d9 100644 (file)
--- a/src/libcharon/sa/ike_sa.c
+++ b/src/libcharon/sa/ike_sa.c
@@ -1209,7 +1209,6 @@ METHOD(ike_sa_t, process_message, status_t,
        {
                case ID_PROT:
                case AGGRESSIVE:
-               case TRANSACTION:
                case IKE_SA_INIT:
                case IKE_AUTH:
                        if (this->state != IKE_CREATED &&

diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c
index 0e88c9e0f3dac32893308aecdc879aa8efde061c..d71f540fe912c6a395a7157b1d2c0fb20e728de5 100644 (file)
--- a/src/libcharon/sa/ikev1/task_manager_v1.c
+++ b/src/libcharon/sa/ikev1/task_manager_v1.c
@@ -879,7 +879,7 @@ static status_t process_request(private_task_manager_t *this,
                                }
                                break;
                        case TRANSACTION:
-                               if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
+                               if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
                                {
                                        task = (task_t *)mode_config_create(this->ike_sa, FALSE);
                                }