From 39c66693a0643dff948c2f97472168884b325106 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Thu, 9 Apr 2020 18:42:22 +0200
Subject: [PATCH] ike-init: Ignore COOKIE payloads during rekeying

This ensures that process_i() only returns NEED_MORE due to multiple
key exchanges or an INVALID_KE_PAYLOAD notify.
---
 src/libcharon/sa/ikev2/tasks/ike_init.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 98185f576..cae68559f 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -1008,6 +1008,12 @@ METHOD(task_t, process_i, status_t,
 					break;
 				case COOKIE:
 				{
+					if (this->old_sa)
+					{
+						DBG1(DBG_IKE, "received COOKIE notify during rekeying"
+						     ", ignored");
+						break;
+					}
 					chunk_free(&this->cookie);
 					this->cookie = chunk_clone(notify->get_notification_data(notify));
 					this->ike_sa->reset(this->ike_sa, FALSE);