ikev2: Ignore COOKIE notifies we already received

This could be due to a delayed response to an IKE_SA_INIT retransmit.

Fixes #2837.

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index b5086182b459db81b7a53df35218ec46543cd611..b570904e21afaa0114bde653e817fda8c17ec508 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -890,6 +890,20 @@ METHOD(task_t, pre_process_i, status_t,
 
                        switch (type)
                        {
+                               case COOKIE:
+                               {
+                                       chunk_t cookie;
+
+                                       cookie = notify->get_notification_data(notify);
+                                       if (chunk_equals(cookie, this->cookie))
+                                       {
+                                               DBG1(DBG_IKE, "ignore response with duplicate COOKIE "
+                                                        "notify");
+                                               enumerator->destroy(enumerator);
+                                               return FAILED;
+                                       }
+                                       break;
+                               }
                                case REDIRECT:
                                {
                                        identification_t *gateway;