reuse an existing IKE_SA to set up additional CHILD_SAs

src/charon/sa/transactions/ike_auth.c

@@ -228,7 +228,6 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 	{	/* build ID payload */
 		my_id_payload = id_payload_create_from_identification(TRUE, my_id);
 		request->add_payload(request, (payload_t*)my_id_payload);
-		this->ike_sa->set_my_id(this->ike_sa, my_id->clone(my_id));
 	}
 	
 	{	/* TODO: build certreq payload */
@@ -889,6 +888,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 							  configured_other_id->get_string(configured_other_id));
 			return DESTROY_ME;
 		}
+		/* update other ID. It was already set, but may contain wildcards */
 		this->ike_sa->set_other_id(this->ike_sa, other_id);
 	}
 	

src/charon/sa/transactions/ike_sa_init.c

@@ -269,6 +269,7 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
 {
 	message_t *request;
 	host_t *me, *other;
+	identification_t *my_id, *other_id;
 	
 	/* check if we already have built a message (retransmission) */
 	if (this->message)
@@ -280,6 +281,13 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
 	me = this->connection->get_my_host(this->connection);
 	other = this->connection->get_other_host(this->connection);
 	
+	/* we already set up the IDs. Mine is already fully qualified, other
+	* will be updated in the ike_auth transaction */
+	my_id = this->policy->get_my_id(this->policy);
+	other_id = this->policy->get_other_id(this->policy);
+	this->ike_sa->set_my_id(this->ike_sa, my_id->clone(my_id));
+	this->ike_sa->set_other_id(this->ike_sa, other_id->clone(other_id));
+	
 	/* build the request */
 	request = message_create();
 	request->set_source(request, me->clone(me));