denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Send correct INVALID_MAJOR_VERSION when receiving packet with unsupported protocol

Browse Source
This commit is contained in:
Martin Willi
2012-03-20 17:31:28 +01:00
parent be83ea7ebf
commit 53300baded
1 changed files with 62 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/network/receiver.c
+62 -39
View File
@@ -136,35 +136,34 @@ struct private_receiver_t {
/** /**
* send a notify back to the sender * send a notify back to the sender
*/ */
static void send_notify(message_t *request, notify_type_t type, chunk_t data) static void send_notify(message_t *request, int major, exchange_type_t exchange,
notify_type_t type, chunk_t data)
{ {
if (request->get_request(request) && ike_sa_id_t *ike_sa_id;
request->get_exchange_type(request) == IKE_SA_INIT) message_t *response;
{ host_t *src, *dst;
message_t *response; packet_t *packet;
host_t *src, *dst;
packet_t *packet;
ike_sa_id_t *ike_sa_id;
response = message_create(IKEV2_MAJOR_VERSION, IKEV2_MINOR_VERSION); response = message_create(major, 0);
dst = request->get_source(request); response->set_exchange_type(response, exchange);
src = request->get_destination(request); response->add_notify(response, FALSE, type, data);
response->set_source(response, src->clone(src)); dst = request->get_source(request);
response->set_destination(response, dst->clone(dst)); src = request->get_destination(request);
response->set_exchange_type(response, request->get_exchange_type(request)); response->set_source(response, src->clone(src));
response->set_destination(response, dst->clone(dst));
if (major == IKEV2_MAJOR_VERSION)
{
response->set_request(response, FALSE); response->set_request(response, FALSE);
response->set_message_id(response, 0);
ike_sa_id = request->get_ike_sa_id(request);
ike_sa_id->switch_initiator(ike_sa_id);
response->set_ike_sa_id(response, ike_sa_id);
response->add_notify(response, FALSE, type, data);
if (response->generate(response, NULL, &packet) == SUCCESS)
{
charon->sender->send(charon->sender, packet);
response->destroy(response);
}
} }
/* TODO-IKEv1: send IKEv1 specific notifies */ response->set_message_id(response, 0);
ike_sa_id = request->get_ike_sa_id(request);
ike_sa_id->switch_initiator(ike_sa_id);
response->set_ike_sa_id(response, ike_sa_id);
if (response->generate(response, NULL, &packet) == SUCCESS)
{
charon->sender->send(charon->sender, packet);
}
response->destroy(response);
} }
/** /**
@@ -286,7 +285,7 @@ static bool drop_ike_sa_init(private_receiver_t *this, message_t *message)
message->get_destination(message)); message->get_destination(message));
DBG2(DBG_NET, "sending COOKIE notify to %H", DBG2(DBG_NET, "sending COOKIE notify to %H",
message->get_source(message)); message->get_source(message));
send_notify(message, COOKIE, cookie); send_notify(message, IKEV2_MAJOR_VERSION, IKE_SA_INIT, COOKIE, cookie);
chunk_free(&cookie); chunk_free(&cookie);
if (++this->secret_used > COOKIE_REUSE) if (++this->secret_used > COOKIE_REUSE)
{ {
@@ -350,6 +349,7 @@ static job_requeue_t receive_packets(private_receiver_t *this)
packet_t *packet; packet_t *packet;
message_t *message; message_t *message;
status_t status; status_t status;
bool supported = TRUE;
/* read in a packet */ /* read in a packet */
status = charon->socket->receive(charon->socket, &packet); status = charon->socket->receive(charon->socket, &packet);
@@ -378,25 +378,48 @@ static job_requeue_t receive_packets(private_receiver_t *this)
/* check IKE major version */ /* check IKE major version */
switch (message->get_major_version(message)) switch (message->get_major_version(message))
{ {
#ifdef USE_IKEV2
case IKEV2_MAJOR_VERSION: case IKEV2_MAJOR_VERSION:
#ifndef USE_IKEV2
if (message->get_exchange_type(message) == IKE_SA_INIT &&
message->get_request(message))
{
send_notify(message, IKEV1_MAJOR_VERSION, INFORMATIONAL_V1,
INVALID_MAJOR_VERSION, chunk_empty);
supported = FALSE;
}
#endif /* USE_IKEV2 */
break; break;
case IKEV1_MAJOR_VERSION:
#ifndef USE_IKEV1
if (message->get_exchange_type(message) == ID_PROT ||
message->get_exchange_type(message) == AGGRESSIVE)
{
send_notify(message, IKEV2_MAJOR_VERSION, INFORMATIONAL,
INVALID_MAJOR_VERSION, chunk_empty);
supported = FALSE;
}
#endif /* USE_IKEV1 */
break;
default:
#ifdef USE_IKEV2
send_notify(message, IKEV2_MAJOR_VERSION, INFORMATIONAL,
INVALID_MAJOR_VERSION, chunk_empty);
#endif /* USE_IKEV2 */ #endif /* USE_IKEV2 */
#ifdef USE_IKEV1 #ifdef USE_IKEV1
case IKEV1_MAJOR_VERSION: send_notify(message, IKEV1_MAJOR_VERSION, INFORMATIONAL_V1,
break; INVALID_MAJOR_VERSION, chunk_empty);
#endif /* USE_IKEV1 */ #endif /* USE_IKEV1 */
default: supported = FALSE;
DBG1(DBG_NET, "received unsupported IKE version %d.%d from %H, " break;
"sending INVALID_MAJOR_VERSION", }
message->get_major_version(message), if (!supported)
message->get_minor_version(message), {
packet->get_source(packet)); DBG1(DBG_NET, "received unsupported IKE version %d.%d from %H, sending "
send_notify(message, INVALID_MAJOR_VERSION, chunk_empty); "INVALID_MAJOR_VERSION", message->get_major_version(message),
message->destroy(message); message->get_minor_version(message), packet->get_source(packet));
return JOB_REQUEUE_DIRECT; message->destroy(message);
return JOB_REQUEUE_DIRECT;
} }
if (message->get_request(message) && if (message->get_request(message) &&
message->get_exchange_type(message) == IKE_SA_INIT) message->get_exchange_type(message) == IKE_SA_INIT)
{ {