denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-init: Ignore COOKIE payloads during rekeying

Browse Source 
This ensures that process_i() only returns NEED_MORE due to multiple
key exchanges or an INVALID_KE_PAYLOAD notify.
This commit is contained in:
Tobias Brunner
2022-06-29 10:28:50 +02:00
parent e5bf9b23b2
commit 39c66693a0
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_init.c
+6
View File
@@ -1008,6 +1008,12 @@ METHOD(task_t, process_i, status_t,
break; break;
case COOKIE: case COOKIE:
{ {
if (this->old_sa)
{
DBG1(DBG_IKE, "received COOKIE notify during rekeying"
", ignored");
break;
}
chunk_free(&this->cookie); chunk_free(&this->cookie);
this->cookie = chunk_clone(notify->get_notification_data(notify)); this->cookie = chunk_clone(notify->get_notification_data(notify));
this->ike_sa->reset(this->ike_sa, FALSE); this->ike_sa->reset(this->ike_sa, FALSE);