denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-create: Fail if we already retried with a requested DH group

Browse Source 
With faulty peers that always return the same unusable DH group in
INVALID_KE_PAYLOADs we'd otherwise get stuck in a loop.
This commit is contained in:
Tobias Brunner
2018-02-23 09:25:46 +01:00
parent 7754c714c1
commit 4f1bf89ed9
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/child_create.c
+9
View File
@@ -1570,6 +1570,15 @@ METHOD(task_t, process_i, status_t,
memcpy(&group, data.ptr, data.len); memcpy(&group, data.ptr, data.len);
group = ntohs(group); group = ntohs(group);
} }
if (this->retry)
{
DBG1(DBG_IKE, "already retried with DH group %N, ignore"
"requested %N", diffie_hellman_group_names,
this->dh_group, diffie_hellman_group_names, group);
handle_child_sa_failure(this, message);
/* an error in CHILD_SA creation is not critical */
return SUCCESS;
}
DBG1(DBG_IKE, "peer didn't accept DH group %N, " DBG1(DBG_IKE, "peer didn't accept DH group %N, "
"it requested %N", diffie_hellman_group_names, "it requested %N", diffie_hellman_group_names,
this->dh_group, diffie_hellman_group_names, group); this->dh_group, diffie_hellman_group_names, group);