From: Martin Willi <martin@revosec.ch>
Date: Mon, 9 Jan 2012 17:12:17 +0000 (+0100)
Subject: Enforce encapsulation mode of configuration, in case initiator proposes both
X-Git-Tag: 5.0.0~338^2~9^2~78
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c40963b457f27464bc88390c7e6419d461264b47;p=thirdparty%2Fstrongswan.git

Enforce encapsulation mode of configuration, in case initiator proposes both
---

diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
index fb7e1a0ff8..dedeab1891 100644
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
@@ -765,7 +765,6 @@ METHOD(task_t, process_r, status_t,
 
 			get_lifetimes(this);
 			apply_lifetimes(this, sa_payload);
-			this->mode = sa_payload->get_encap_mode(sa_payload, &udp);
 
 			if (!this->proposal)
 			{
@@ -799,6 +798,7 @@ METHOD(task_t, process_r, status_t,
 
 			check_for_rekeyed_child(this);
 
+			udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 			this->child_sa = child_sa_create(
 									this->ike_sa->get_my_host(this->ike_sa),
 									this->ike_sa->get_other_host(this->ike_sa),
@@ -846,6 +846,7 @@ METHOD(task_t, build_r, status_t,
 			this->proposal->set_spi(this->proposal, this->spi_r);
 
 			udp = this->child_sa->has_encap(this->child_sa);
+			this->mode = this->config->get_mode(this->config);
 			if (udp && this->mode == MODE_TRANSPORT)
 			{
 				/* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */