ikev2: raise LOCAL_AUTH_FAILED when receiving INFORMATIONAL with AUTH_FAILED

diff --git a/src/libcharon/sa/ikev2/tasks/ike_delete.c b/src/libcharon/sa/ikev2/tasks/ike_delete.c
index f127b0c150ae23087ef91eef54edba1a2a8e0de2..9bc62bf2a835dff69abc75dbef3d6cf9880af47f 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_delete.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_delete.c
@@ -109,6 +109,14 @@ METHOD(task_t, process_r, status_t,
                 this->ike_sa->get_other_host(this->ike_sa),
                 this->ike_sa->get_other_id(this->ike_sa));
 
+       if (message->get_exchange_type(message) == INFORMATIONAL &&
+               message->get_notify(message, AUTHENTICATION_FAILED))
+       {
+               /* a late AUTHENTICATION_FAILED notify from the initiator after
+                * we have established the IKE_SA: signal auth failure */
+               charon->bus->alert(charon->bus, ALERT_LOCAL_AUTH_FAILED);
+       }
+
        switch (this->ike_sa->get_state(this->ike_sa))
        {
                case IKE_ESTABLISHED: