denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

receiver: Restrict init limit to half-open SAs as responder

Browse Source 
Signed-off-by: Thomas Egerer <[email protected]>
This commit is contained in:
Thomas Egerer
2017-05-23 17:53:20 +02:00
committed by Tobias Brunner
parent 6b9361f714
commit 3a67df3b10
1 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/network/receiver.c
+2 -4
View File
@@ -321,18 +321,16 @@ static bool cookie_required(private_receiver_t *this,
*/ */
static bool drop_ike_sa_init(private_receiver_t *this, message_t *message) static bool drop_ike_sa_init(private_receiver_t *this, message_t *message)
{ {
u_int half_open, half_open_r; u_int half_open;
uint32_t now; uint32_t now;
now = time_monotonic(NULL); now = time_monotonic(NULL);
half_open = charon->ike_sa_manager->get_half_open_count( half_open = charon->ike_sa_manager->get_half_open_count(
charon->ike_sa_manager, NULL, FALSE);
half_open_r = charon->ike_sa_manager->get_half_open_count(
charon->ike_sa_manager, NULL, TRUE); charon->ike_sa_manager, NULL, TRUE);
/* check for cookies in IKEv2 */ /* check for cookies in IKEv2 */
if (message->get_major_version(message) == IKEV2_MAJOR_VERSION && if (message->get_major_version(message) == IKEV2_MAJOR_VERSION &&
cookie_required(this, half_open_r, now) && !check_cookie(this, message)) cookie_required(this, half_open, now) && !check_cookie(this, message))
{ {
chunk_t cookie; chunk_t cookie;