From c40e8214eda0177563cc9cb1208d5df8fdc7a65c Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 10 Jul 2026 20:24:51 +0200 Subject: [PATCH] ike-init: Make sure we received a KE payload as initiator On the responder, dc8b479eb890 ("ike-init: Fix key derivation if SA is reset after IKE_INTERMEDIATE retransmits") fixed this. But the initiator still accepted IKE_INTERMEDIATE exchanges without KE payload. Fixes: 0d49ddec2ef5 ("ike-init: Add support for multiple key exchanges") --- src/libcharon/sa/ikev2/tasks/ike_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c index a28996225..bdcf1f013 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_init.c +++ b/src/libcharon/sa/ikev2/tasks/ike_init.c @@ -939,6 +939,7 @@ static void process_payloads_multi_ke(private_ike_init_t *this, else { DBG1(DBG_IKE, "KE payload missing in message"); + this->ke_failed = TRUE; } }