denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs

Browse Source 
Prevents a responder peer to trick us into established state by starting
IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH.

Fixes CVE-2014-2338.
This commit is contained in:
Martin Willi
2014-04-14 13:29:49 +02:00
committed by Tobias Brunner
parent abd7d3be9c
commit 8503077175
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/task_manager_v2.c
+9
View File
@@ -778,6 +778,15 @@ static status_t process_request(private_task_manager_t *this,
case CREATE_CHILD_SA: case CREATE_CHILD_SA:
{ /* FIXME: we should prevent this on mediation connections */ { /* FIXME: we should prevent this on mediation connections */
bool notify_found = FALSE, ts_found = FALSE; bool notify_found = FALSE, ts_found = FALSE;
if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED ||
this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING)
{
DBG1(DBG_IKE, "received CREATE_CHILD_SA request for "
"unestablished IKE_SA, rejected");
return FAILED;
}
enumerator = message->create_payload_enumerator(message); enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload)) while (enumerator->enumerate(enumerator, &payload))
{ {