ike-init: Ignore COOKIE payloads during rekeying

This ensures that process_i() only returns NEED_MORE due to multiple
key exchanges or an INVALID_KE_PAYLOAD notify.

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 98185f576e797418510cc44ee378435570f72d44..cae68559fca8f7feb336f31701f6eb0875adde57 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -1008,6 +1008,12 @@ METHOD(task_t, process_i, status_t,
                                        break;
                                case COOKIE:
                                {
+                                       if (this->old_sa)
+                                       {
+                                               DBG1(DBG_IKE, "received COOKIE notify during rekeying"
+                                                    ", ignored");
+                                               break;
+                                       }
                                        chunk_free(&this->cookie);
                                        this->cookie = chunk_clone(notify->get_notification_data(notify));
                                        this->ike_sa->reset(this->ike_sa, FALSE);