denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Drop IKE_SA_INIT messages that don't have the initiator flag set

Browse Source 
While this doesn't really create any problems it is not 100% correct to
accept such messages because, of course, the sender of an IKE_SA_INIT
request is always the original initiator of an IKE_SA.

We currently don't check the flag later, so we wouldn't notice if the
peer doesn't set it in later messages (ike_sa_id_t.equals doesn't
compare it anymore since we added support for IKEv1, in particular since
17ec1c74de).
This commit is contained in:
Tobias Brunner
2015-08-20 16:05:02 +02:00
parent 47ee60177e
commit 47a340e1f7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/network/receiver.c
+3 -1
View File
@@ -542,7 +542,9 @@ static job_requeue_t receive_packets(private_receiver_t *this)
if (message->get_request(message) && if (message->get_request(message) &&
message->get_exchange_type(message) == IKE_SA_INIT) message->get_exchange_type(message) == IKE_SA_INIT)
{ {
if (this->initiator_only || drop_ike_sa_init(this, message)) id = message->get_ike_sa_id(message);
if (this->initiator_only || !id->is_initiator(id) ||
drop_ike_sa_init(this, message))
{ {
message->destroy(message); message->destroy(message);
return JOB_REQUEUE_DIRECT; return JOB_REQUEUE_DIRECT;