1 files changed, 36 insertions, 24 deletions

diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
index 86d9f4c22..fdcfa0a20 100644
--- a/src/libcharon/sa/trap_manager.c
+++ b/src/libcharon/sa/trap_manager.c
@@ -98,7 +98,7 @@ METHOD(trap_manager_t, install, u_int32_t,
 	ike_cfg_t *ike_cfg;
 	child_sa_t *child_sa;
 	host_t *me, *other;
-	linked_list_t *my_ts, *other_ts;
+	linked_list_t *my_ts, *other_ts, *list;
 	enumerator_t *enumerator;
 	bool found = FALSE;
 	status_t status;
@@ -127,14 +127,14 @@ METHOD(trap_manager_t, install, u_int32_t,
 
 	/* try to resolve addresses */
 	ike_cfg = peer->get_ike_cfg(peer);
-	other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg),
+	other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg, NULL),
 								 0, ike_cfg->get_other_port(ike_cfg));
 	if (!other || other->is_anyaddr(other))
 	{
 		DBG1(DBG_CFG, "installing trap failed, remote address unknown");
 		return 0;
 	}
-	me = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg),
+	me = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg, NULL),
 					other->get_family(other), ike_cfg->get_my_port(ike_cfg));
 	if (!me || me->is_anyaddr(me))
 	{
@@ -152,10 +152,14 @@ METHOD(trap_manager_t, install, u_int32_t,
 
 	/* create and route CHILD_SA */
 	child_sa = child_sa_create(me, other, child, 0, FALSE);
-	my_ts = child->get_traffic_selectors(child, TRUE, NULL, me);
-	other_ts = child->get_traffic_selectors(child, FALSE, NULL, other);
-	me->destroy(me);
-	other->destroy(other);
+
+	list = linked_list_create_with_items(me, NULL);
+	my_ts = child->get_traffic_selectors(child, TRUE, NULL, list);
+	list->destroy_offset(list, offsetof(host_t, destroy));
+
+	list = linked_list_create_with_items(other, NULL);
+	other_ts = child->get_traffic_selectors(child, FALSE, NULL, list);
+	list->destroy_offset(list, offsetof(host_t, destroy));
 
 	/* while we don't know the finally negotiated protocol (ESP|AH), we
 	 * could iterate all proposals for a best guess (TODO). But as we
@@ -284,26 +288,34 @@ METHOD(trap_manager_t, acquire, void,
 
 	ike_sa = charon->ike_sa_manager->checkout_by_config(
 											charon->ike_sa_manager, peer);
-	if (ike_sa->get_peer_cfg(ike_sa) == NULL)
-	{
-		ike_sa->set_peer_cfg(ike_sa, peer);
-	}
-	if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
+	if (ike_sa)
 	{
-		/* make sure the entry is still there */
-		this->lock->read_lock(this->lock);
-		if (this->traps->find_first(this->traps, NULL,
-									(void**)&found) == SUCCESS)
+		if (ike_sa->get_peer_cfg(ike_sa) == NULL)
 		{
-			found->ike_sa = ike_sa;
+			ike_sa->set_peer_cfg(ike_sa, peer);
+		}
+		if (ike_sa->get_version(ike_sa) == IKEV1)
+		{	/* in IKEv1, don't prepend the acquiring packet TS, as we only
+			 * have a single TS that we can establish in a Quick Mode. */
+			src = dst = NULL;
+		}
+		if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
+		{
+			/* make sure the entry is still there */
+			this->lock->read_lock(this->lock);
+			if (this->traps->find_first(this->traps, NULL,
+										(void**)&found) == SUCCESS)
+			{
+				found->ike_sa = ike_sa;
+			}
+			this->lock->unlock(this->lock);
+			charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+		}
+		else
+		{
+			charon->ike_sa_manager->checkin_and_destroy(
+												charon->ike_sa_manager, ike_sa);
 		}
-		this->lock->unlock(this->lock);
-		charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-	}
-	else
-	{
-		charon->ike_sa_manager->checkin_and_destroy(
-											charon->ike_sa_manager, ike_sa);
 	}
 	peer->destroy(peer);
 }