denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-init: Move creation of DH instance after INVALID_KE_PAYLOAD to build_i()

Browse Source 
This way we get proper error handling if the DH group the peer requested
is not actually supported for some reason (otherwise we'd just retry to
initiate with the configured group and get back another notify).
This commit is contained in:
Tobias Brunner
2018-02-09 10:20:05 +01:00
parent d058fd3c32
commit 18242f62c2
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_init.c
+12 -6
View File
@@ -544,6 +544,18 @@ METHOD(task_t, build_i, status_t,
return FAILED;
}
}
else if (this->dh->get_dh_group(this->dh) != this->dh_group)
{ /* reset DH instance if group changed (INVALID_KE_PAYLOAD) */
this->dh->destroy(this->dh);
this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
this->dh_group);
if (!this->dh)
{
DBG1(DBG_IKE, "requested DH group %N not supported",
diffie_hellman_group_names, this->dh_group);
return FAILED;
}
}
/* generate nonce only when we are trying the first time */
if (this->my_nonce.ptr == NULL)
@@ -929,12 +941,6 @@ METHOD(task_t, migrate, void,
this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
this->proposal = NULL;
this->dh_failed = FALSE;
if (this->dh && this->dh->get_dh_group(this->dh) != this->dh_group)
{ /* reset DH value only if group changed (INVALID_KE_PAYLOAD) */
this->dh->destroy(this->dh);
this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
this->dh_group);
}
}
METHOD(task_t, destroy, void,