denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FreeBSD and Mac OS X both set the sequence number of an SADB_X_SPDGET response to zero, we accept that for now.

Browse Source
This commit is contained in:
Tobias Brunner
2009-08-04 11:08:58 +02:00
parent e8c3cdb25b
commit 56ee8fcc96
1 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+16 -5
View File
@@ -751,6 +751,8 @@ static status_t pfkey_send_socket(private_kernel_pfkey_ipsec_t *this, int socket
this->mutex_pfkey->lock(this->mutex_pfkey); this->mutex_pfkey->lock(this->mutex_pfkey);
/* FIXME: our usage of sequence numbers is probably wrong. check RFC 2367,
* in particular the behavior in response to an SADB_ACQUIRE. */
in->sadb_msg_seq = ++this->seq; in->sadb_msg_seq = ++this->seq;
in->sadb_msg_pid = getpid(); in->sadb_msg_pid = getpid();
@@ -812,14 +814,23 @@ static status_t pfkey_send_socket(private_kernel_pfkey_ipsec_t *this, int socket
} }
if (msg->sadb_msg_seq != this->seq) if (msg->sadb_msg_seq != this->seq)
{ {
DBG1(DBG_KNL, "received PF_KEY message with invalid sequence number, " DBG1(DBG_KNL, "received PF_KEY message with unexpected sequence "
"was %d expected %d", msg->sadb_msg_seq, this->seq); "number, was %d expected %d", msg->sadb_msg_seq, this->seq);
if (msg->sadb_msg_seq < this->seq) if (msg->sadb_msg_seq == 0)
{
/* FreeBSD and Mac OS X do this for the response to
* SADB_X_SPDGET (but not for the response to SADB_GET).
* FreeBSD: 'key_spdget' in /usr/src/sys/netipsec/key.c. */
}
else if (msg->sadb_msg_seq < this->seq)
{ {
continue; continue;
} }
this->mutex_pfkey->unlock(this->mutex_pfkey); else
return FAILED; {
this->mutex_pfkey->unlock(this->mutex_pfkey);
return FAILED;
}
} }
if (msg->sadb_msg_type != in->sadb_msg_type) if (msg->sadb_msg_type != in->sadb_msg_type)
{ {