ike-init: Fail if DH group in KE payload does not match proposed group

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 58b710616e3079e69d329a299b549a646a9474e9..9a207ac6b1da52fbfda8bb944b7f317a1a0c22c3 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -502,7 +502,11 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
                        this->dh = this->keymat->keymat.create_dh(
                                                                &this->keymat->keymat, this->dh_group);
                }
-               if (this->dh)
+               else if (this->dh)
+               {
+                       this->dh_failed = this->dh->get_dh_group(this->dh) != this->dh_group;
+               }
+               if (this->dh && !this->dh_failed)
                {
                        this->dh_failed = !this->dh->set_other_public_value(this->dh,
                                                                ke_payload->get_key_exchange_data(ke_payload));