Handle INFORMATIONAL_V1 messages when no keys have been derived yet.
This allows to gracefully process the INFORMATIONAL_V1 message rules which require the payloads to be encrypted and thus the exchange to be authenticated with a HASH payload. If such an exchange is now initiated before the ISAKMP_SA is established, the message is simply sent unencrypted and without HASH payload.
This commit is contained in:
@@ -759,6 +759,11 @@ METHOD(keymat_v1_t, get_hash_phase2, chunk_t,
|
||||
bool add_message = TRUE;
|
||||
char *name = "Hash";
|
||||
|
||||
if (!this->prf)
|
||||
{ /* no keys derived yet */
|
||||
return hash;
|
||||
}
|
||||
|
||||
/* Hashes are simple for most exchanges in Phase 2:
|
||||
* Hash = prf(SKEYID_a, M-ID | Complete message after HASH payload)
|
||||
* For Quick Mode there are three hashes:
|
||||
|
||||
Reference in New Issue
Block a user