denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reject initial exchange messages early once IKE_SA is established

Browse Source
This commit is contained in:
Martin Willi
2012-08-02 13:04:54 +02:00
parent 804d702b0a
commit 394b9f6b65
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.c
+18
View File
@@ -1205,6 +1205,24 @@ METHOD(ike_sa_t, process_message, status_t,
{ /* do not handle messages in passive state */ { /* do not handle messages in passive state */
return FAILED; return FAILED;
} }
switch (message->get_exchange_type(message))
{
case ID_PROT:
case AGGRESSIVE:
case TRANSACTION:
case IKE_SA_INIT:
case IKE_AUTH:
if (this->state != IKE_CREATED &&
this->state != IKE_CONNECTING)
{
DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
exchange_type_names, message->get_exchange_type(message));
return FAILED;
}
break;
default:
break;
}
if (message->get_major_version(message) != this->version) if (message->get_major_version(message) != this->version)
{ {
DBG1(DBG_IKE, "ignoring %N IKEv%u exchange on %N SA", DBG1(DBG_IKE, "ignoring %N IKEv%u exchange on %N SA",