Hi Paul,

could you give me some reproducer for that? I think, I understand the issue, but I do not know what I have to looking for in the log file. For test I used this configuration file:

config setup
    protostack=netkey
    plutodebug=all
    plutostderrlog=${PLUTO_LOG}

conn test
    left=${syncCLIENT}
    right=${syncSERVER}
    authby=secret
    auto=add
    ikev2=insist
    ike=aes_gcm-sha2_512


One more question. I read your patch and it seems to me, there are two, non-related, parts - dcookie and nonce. Am I right or these parts are related?

when running with plutodebug=all, look for something like:

May  5 10:21:25: | ***parse ISAKMP Nonce Payload:
May  5 10:21:25: |    next payload type: ISAKMP_NEXT_KE (0x4)
May  5 10:21:25: |    length: 24 (0x18)

You should see the different sizes on length.

the dcookie part of that commit is unrelated to the nonce size.


This fix will come in via a rebase

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2603.html