denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid parsing retransmits we already responded to.

Browse Source 
Decryption will fail as we already moved the IV when we sent the
response. Without this change, encrypted retransmits would have been
discarded during parsing already.
This commit is contained in:
Tobias Brunner
2012-03-20 17:31:08 +01:00
parent 68c6863bbb
commit 1960312cfd
1 changed files with 38 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/task_manager_v1.c
+38 -33
View File
@@ -653,46 +653,22 @@ METHOD(task_manager_t, process_message, status_t,
host_t *me, *other;
status_t status;
status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
if (status != SUCCESS)
{
return status;
}
/* TODO-IKEv1: update hosts more selectively */
me = msg->get_destination(msg);
other = msg->get_source(msg);
/* if this IKE_SA is virgin, we check for a config */
if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
{
ike_sa_id_t *ike_sa_id;
ike_cfg_t *ike_cfg;
job_t *job;
ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
if (ike_cfg == NULL)
{
/* no config found for these hosts, destroy */
DBG1(DBG_IKE, "no IKE config found for %H...%H", me, other);
return DESTROY_ME;
}
this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
ike_cfg->destroy(ike_cfg);
/* add a timeout if peer does not establish it completely */
ike_sa_id = this->ike_sa->get_id(this->ike_sa);
job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
lib->scheduler->schedule_job(lib->scheduler, job,
lib->settings->get_int(lib->settings,
"charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
}
this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
time_monotonic(NULL));
/* TODO-IKEv1: update hosts more selectively */
mid = msg->get_message_id(msg);
if ((mid && mid == this->initiating.mid) ||
(this->initiating.mid == 0 &&
this->active_tasks->get_count(this->active_tasks)))
{
status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
if (status != SUCCESS)
{
return status;
}
this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
time_monotonic(NULL));
this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
charon->bus->message(charon->bus, msg, FALSE);
if (process_response(this, msg) != SUCCESS)
@@ -712,6 +688,35 @@ METHOD(task_manager_t, process_message, status_t,
this->responding.packet->clone(this->responding.packet));
return SUCCESS;
}
status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
if (status != SUCCESS)
{
return status;
}
/* if this IKE_SA is virgin, we check for a config */
if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
{
ike_sa_id_t *ike_sa_id;
ike_cfg_t *ike_cfg;
job_t *job;
ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
if (ike_cfg == NULL)
{
/* no config found for these hosts, destroy */
DBG1(DBG_IKE, "no IKE config found for %H...%H", me, other);
return DESTROY_ME;
}
this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
ike_cfg->destroy(ike_cfg);
/* add a timeout if peer does not establish it completely */
ike_sa_id = this->ike_sa->get_id(this->ike_sa);
job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
lib->scheduler->schedule_job(lib->scheduler, job,
lib->settings->get_int(lib->settings,
"charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
}
this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
time_monotonic(NULL));
this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
charon->bus->message(charon->bus, msg, TRUE);
if (process_request(this, msg) != SUCCESS)