ike-sa-manager: Make sure the message ID of initial messages is 0

It is mandated by the RFCs and it is expected by the task managers.

Initial messages with invalid MID will be treated like regular messages,
so no IKE_SA will be created for them.  Instead, if the responder SPI is 0
no SA will be found and the message is rejected with ALERT_INVALID_IKE_SPI.
If an SPI is set and we do find an SA, then we either ignore the message
because the MID is unexpected, or because we don't allow initial messages
on established connections.

There is one exception, though, if an attacker can slip in an IKE_SA_INIT
with both SPIs set before the client's IKE_AUTH is handled by the server,
it does get processed (see next commit).

References #816.

0 files changed, 0 insertions, 0 deletions