denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid parsing retransmits we already responded to.

Browse Source 
Decryption will fail as we already moved the IV when we sent the
response. Without this change, encrypted retransmits would have been
discarded during parsing already.
This commit is contained in:
Tobias Brunner
2012-03-20 17:31:08 +01:00
parent 68c6863bbb
commit 1960312cfd
1 changed files with 38 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/task_manager_v1.c
+35 -30
View File
@@ -653,15 +653,46 @@ METHOD(task_manager_t, process_message, status_t,
host_t *me, *other; host_t *me, *other;
status_t status; status_t status;
/* TODO-IKEv1: update hosts more selectively */
me = msg->get_destination(msg);
other = msg->get_source(msg);
mid = msg->get_message_id(msg);
if ((mid && mid == this->initiating.mid) ||
(this->initiating.mid == 0 &&
this->active_tasks->get_count(this->active_tasks)))
{
status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
if (status != SUCCESS)
{
return status;
}
this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
time_monotonic(NULL));
this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
charon->bus->message(charon->bus, msg, FALSE);
if (process_response(this, msg) != SUCCESS)
{
flush(this);
return DESTROY_ME;
}
}
else
{
hash = chunk_hash(msg->get_packet_data(msg));
if (hash == this->responding.hash)
{
DBG1(DBG_IKE, "received retransmit of request with ID %d, "
"retransmitting response", mid);
charon->sender->send(charon->sender,
this->responding.packet->clone(this->responding.packet));
return SUCCESS;
}
status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa)); status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
if (status != SUCCESS) if (status != SUCCESS)
{ {
return status; return status;
} }
me = msg->get_destination(msg);
other = msg->get_source(msg);
/* if this IKE_SA is virgin, we check for a config */ /* if this IKE_SA is virgin, we check for a config */
if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL) if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
{ {
@@ -686,32 +717,6 @@ METHOD(task_manager_t, process_message, status_t,
} }
this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
time_monotonic(NULL)); time_monotonic(NULL));
/* TODO-IKEv1: update hosts more selectively */
mid = msg->get_message_id(msg);
if ((mid && mid == this->initiating.mid) ||
(this->initiating.mid == 0 &&
this->active_tasks->get_count(this->active_tasks)))
{
this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
charon->bus->message(charon->bus, msg, FALSE);
if (process_response(this, msg) != SUCCESS)
{
flush(this);
return DESTROY_ME;
}
}
else
{
hash = chunk_hash(msg->get_packet_data(msg));
if (hash == this->responding.hash)
{
DBG1(DBG_IKE, "received retransmit of request with ID %d, "
"retransmitting response", mid);
charon->sender->send(charon->sender,
this->responding.packet->clone(this->responding.packet));
return SUCCESS;
}
this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE); this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
charon->bus->message(charon->bus, msg, TRUE); charon->bus->message(charon->bus, msg, TRUE);
if (process_request(this, msg) != SUCCESS) if (process_request(this, msg) != SUCCESS)