ipsec: initialize msgid and allow no dh in child sa
set msgid to 0 not random.
allow for no DH in ESP child SA
Ticket:
Type: fix
@@ -2575,6 +2575,8 @@ ikev2_set_initiator_proposals (vlib_main_t * vm, ikev2_sa_t * sa,
}
/* DH */
+ if (is_ike || ts->dh_type != IKEV2_TRANSFORM_DH_TYPE_NONE)
+ {
error = 1;
vec_foreach (td, km->supported_transforms)
{
@@ -2594,6 +2596,7 @@ ikev2_set_initiator_proposals (vlib_main_t * vm, ikev2_sa_t * sa,
r = clib_error_return (0, "Unsupported algorithm");
return r;
}
+ }
if (!is_ike)
{
@@ -3057,6 +3060,7 @@ ikev2_initiate_sa_init (vlib_main_t * vm, u8 * name)
ike0->exchange = IKEV2_EXCHANGE_SA_INIT;
ike0->ispi = sa.ispi;
ike0->rspi = 0;
+ ike0->msgid = 0;
/* store whole IKE payload - needed for PSK auth */
vec_free (sa.last_sa_init_req_packet_data);
