denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check message version before processing it on an IKE_SA

Browse Source
This commit is contained in:
Martin Willi
2012-03-20 17:31:29 +01:00
parent 986237603f
commit 448e2e2945
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.c
+10
View File
@@ -1117,6 +1117,16 @@ METHOD(ike_sa_t, process_message, status_t,
{ /* do not handle messages in passive state */ { /* do not handle messages in passive state */
return FAILED; return FAILED;
} }
if (message->get_major_version(message) != this->version)
{
DBG1(DBG_IKE, "ignoring %N IKEv%u exchange on %N SA",
exchange_type_names, message->get_exchange_type(message),
message->get_major_version(message),
ike_version_names, this->version);
/* TODO-IKEv1: fall back to IKEv1 if we receive an IKEv1
* INVALID_MAJOR_VERSION on an IKEv2 SA. */
return FAILED;
}
status = this->task_manager->process_message(this->task_manager, message); status = this->task_manager->process_message(this->task_manager, message);
if (this->flush_auth_cfg && this->state == IKE_ESTABLISHED) if (this->flush_auth_cfg && this->state == IKE_ESTABLISHED)
{ {