denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-rekey: Ignore failed colliding CHILD_SA rekeyings

Browse Source 
If a passive rekeying fails due to an INVALID_KE_PAYLOAD we don't want
to consider this task later when resolving collisions.  This previously
might have caused the wrong SA to get deleted/installed based on the nonces
in the unsuccessful exchange.
This commit is contained in:
Tobias Brunner
2016-06-17 18:48:08 +02:00
parent b4f24ac0f6
commit 6d8041d46b
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/child_rekey.c
+10 -1
View File
@@ -455,9 +455,18 @@ METHOD(child_rekey_t, collide, void,
if (other->get_type(other) == TASK_CHILD_REKEY)
{
private_child_rekey_t *rekey = (private_child_rekey_t*)other;
child_sa_t *other_child;
if (rekey->child_sa != this->child_sa)
{ /* not the same child => no collision */
other->destroy(other);
return;
}
/* ignore passive tasks that did not successfully create a CHILD_SA */
other_child = rekey->child_create->get_child(rekey->child_create);
if (!other_child ||
other_child->get_state(other_child) != CHILD_INSTALLED)
{
/* not the same child => no collision */
other->destroy(other);
return;
}