denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike: Fix untracking IKE_SA_INITs with non-zero MIDs and SPIs as half-open SAs

Browse Source 
We track all IKE_SA_INIT requests as half-open IKE_SAs but didn't
correctly untrack them if their message ID or responder SPI was non-zero.

References strongswan/strongswan#1775

Fixes: b866ee88bf ("ike: Track unprocessed initial IKE messages like half-open IKE_SAs")
This commit is contained in:
Tobias Brunner
2023-07-26 15:13:43 +02:00
parent 849c2c9707
commit 0b47357091
1 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.c
+12 -11
View File
@@ -1326,22 +1326,25 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
be64toh(id->get_initiator_spi(id)), be64toh(id->get_initiator_spi(id)),
be64toh(id->get_responder_spi(id))); be64toh(id->get_responder_spi(id)));
if (id->get_responder_spi(id) == 0 && if (message->get_request(message) &&
message->get_message_id(message) == 0) message->get_exchange_type(message) == IKE_SA_INIT)
{ {
if (message->get_major_version(message) == IKEV2_MAJOR_VERSION) untrack_half_open = TRUE;
{
if (message->get_exchange_type(message) == IKE_SA_INIT && if (message->get_message_id(message) == 0 &&
message->get_request(message)) id->get_responder_spi(id) == 0)
{ {
ike_version = IKEV2; ike_version = IKEV2;
is_init = TRUE; is_init = TRUE;
} }
} }
else else if ((message->get_exchange_type(message) == ID_PROT ||
message->get_exchange_type(message) == AGGRESSIVE) &&
id->get_responder_spi(id) == 0)
{ {
if (message->get_exchange_type(message) == ID_PROT || untrack_half_open = TRUE;
message->get_exchange_type(message) == AGGRESSIVE)
if (message->get_message_id(message) == 0)
{ {
ike_version = IKEV1; ike_version = IKEV1;
is_init = TRUE; is_init = TRUE;
@@ -1351,7 +1354,6 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
} }
} }
} }
}
if (is_init) if (is_init)
{ {
@@ -1359,7 +1361,6 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
uint64_t our_spi; uint64_t our_spi;
chunk_t hash; chunk_t hash;
untrack_half_open = TRUE;
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher || !get_init_hash(hasher, message, &hash)) if (!hasher || !get_init_hash(hasher, message, &hash))
{ {