*/
u_int32_t reqid;
+ /**
+ * Negotiated mode, tunnel or transport
+ */
+ ipsec_mode_t mode;
+
/** states of quick mode */
enum {
QM_INIT,
this->child_sa->set_proposal(this->child_sa, this->proposal);
this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
- this->child_sa->set_mode(this->child_sa, MODE_TUNNEL);
+ this->child_sa->set_mode(this->child_sa, this->mode);
this->child_sa->set_protocol(this->child_sa,
this->proposal->get_protocol(this->proposal));
sa_payload_t *sa_payload;
linked_list_t *list;
proposal_t *proposal;
- ipsec_mode_t mode;
diffie_hellman_group_t group;
- bool udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
+ bool udp;
+ udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
this->child_sa = child_sa_create(
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
}
enumerator->destroy(enumerator);
- mode = this->config->get_mode(this->config);
- if (udp && mode == MODE_TRANSPORT)
+ this->mode = this->config->get_mode(this->config);
+ if (udp && this->mode == MODE_TRANSPORT)
{
/* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
add_nat_oa_payloads(this, message);
get_lifetimes(this);
sa_payload = sa_payload_create_from_proposals_v1(list,
this->lifetime, this->lifebytes, AUTH_NONE,
- mode, udp);
+ this->mode, udp);
list->destroy_offset(list, offsetof(proposal_t, destroy));
message->add_payload(message, &sa_payload->payload_interface);
peer_cfg_t *peer_cfg;
host_t *me, *other;
u_int16_t group;
- bool udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
+ bool udp;
if (!get_ts(this, message))
{
get_lifetimes(this);
apply_lifetimes(this, sa_payload);
+ this->mode = sa_payload->get_encap_mode(sa_payload, &udp);
if (!this->proposal)
{
case QM_INIT:
{
sa_payload_t *sa_payload;
- ipsec_mode_t mode;
- bool udp = this->child_sa->has_encap(this->child_sa);
+ bool udp;
this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
if (!this->spi_r)
}
this->proposal->set_spi(this->proposal, this->spi_r);
- mode = this->config->get_mode(this->config);
- if (udp && mode == MODE_TRANSPORT)
+ udp = this->child_sa->has_encap(this->child_sa);
+ if (udp && this->mode == MODE_TRANSPORT)
{
/* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
add_nat_oa_payloads(this, message);
sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
this->lifetime, this->lifebytes, AUTH_NONE,
- mode, udp);
+ this->mode, udp);
message->add_payload(message, &sa_payload->payload_interface);
if (!add_nonce(this, &this->nonce_r, message))