denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improved logging on verify errors for some payloads

Browse Source 
enforcing IKE_SA shutdown, even when transactions are outstanding
proper reject of CREATE_CHILD_SA message with KE payload
This commit is contained in:
Martin Willi
2006-07-13 12:49:35 +00:00
parent 7af345e11e
commit 325e497798
6 changed files with 59 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/ike_sa.c
+7
View File
@@ -1258,6 +1258,13 @@ static status_t delete_(private_ike_sa_t *this)
delete_ike_sa_t *delete_ike_sa;
delete_ike_sa = delete_ike_sa_create(&this->public);
if (this->transaction_out)
{
/* already a transaction in progress. As this may hang
* around a while, we don't inform the other peer. */
return DESTROY_ME;
}
return queue_transaction(this, (transaction_t*)delete_ike_sa, FALSE);
}
src/charon/sa/transactions/create_child_sa.c
+16 -7
View File
@@ -370,7 +370,7 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
/**
* Build a notify message.
*/
static void build_notify(notify_type_t type, message_t *message, bool flush_message)
static void build_notify(notify_type_t type, chunk_t data, message_t *message, bool flush_message)
{
notify_payload_t *notify;
@@ -388,6 +388,7 @@ static void build_notify(notify_type_t type, message_t *message, bool flush_mess
notify = notify_payload_create();
notify->set_notify_type(notify, type);
notify->set_notification_data(notify, data);
message->add_payload(message, (payload_t*)notify);
}
@@ -520,7 +521,15 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
break;
case TRAFFIC_SELECTOR_RESPONDER:
tsr_request = (ts_payload_t*)payload;
break;
case KEY_EXCHANGE:
{
u_int8_t dh_buffer[] = {0x00, 0x00}; /* MODP_NONE */
chunk_t group = chunk_from_buf(dh_buffer);
build_notify(INVALID_KE_PAYLOAD, group, response, TRUE);
this->logger->log(this->logger, CONTROL,
"CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
return FAILED;
}
case NOTIFY:
{
status = process_notifys(this, (notify_payload_t*)payload);
@@ -545,7 +554,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
/* check if we have all payloads */
if (!(sa_request && nonce_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, response, TRUE);
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
this->logger->log(this->logger, AUDIT,
"request message incomplete, no CHILD_SA created");
return FAILED;
@@ -556,7 +565,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &this->nonce_r) != SUCCESS)
{
build_notify(NO_PROPOSAL_CHOSEN, response, TRUE);
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
nonce_response = nonce_payload_create();
@@ -600,7 +609,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
{
this->logger->log(this->logger, AUDIT,
"CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, response, TRUE);
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
/* do we have traffic selectors? */
@@ -608,7 +617,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
{
this->logger->log(this->logger, AUDIT,
"CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, response, TRUE);
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
else
@@ -629,7 +638,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
{
this->logger->log(this->logger, ERROR,
"installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, response, TRUE);
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
/* add proposal to sa payload */