From b8160377398e3a2e2e040824cedbf863518e98ec Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 20 Dec 2012 11:55:33 +0100 Subject: [PATCH] Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments Other implementations send fragments always in an initial message type even for transaction or quick mode exchanges. --- src/libcharon/sa/ike_sa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index de050cd3c..4029db11d 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -1232,7 +1232,8 @@ METHOD(ike_sa_t, process_message, status_t, case IKE_SA_INIT: case IKE_AUTH: if (this->state != IKE_CREATED && - this->state != IKE_CONNECTING) + this->state != IKE_CONNECTING && + message->get_first_payload_type(message) != FRAGMENT_V1) { DBG1(DBG_IKE, "ignoring %N in established IKE_SA state", exchange_type_names, message->get_exchange_type(message));