denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-rekey: Only set reqid on new CHILD_SA if it was allocated dynamically

Browse Source 
Keeping a reference ensures that if the old SA expires before the new
one is installed, the previous reqid isn't reallocated to a concurrently
established CHILD_SA with different selectors.
This commit is contained in:
Tobias Brunner
2023-11-13 12:02:11 +01:00
parent 4ea739baf4
commit bc39a3aecb
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/child_rekey.c
+15 -3
View File
@@ -213,8 +213,12 @@ METHOD(task_t, build_i, status_t,
this->child_create->use_dh_group(this->child_create, dh_group); this->child_create->use_dh_group(this->child_create, dh_group);
} }
} }
reqid = this->child_sa->get_reqid(this->child_sa); reqid = this->child_sa->get_reqid_ref(this->child_sa);
if (reqid)
{
this->child_create->use_reqid(this->child_create, reqid); this->child_create->use_reqid(this->child_create, reqid);
charon->kernel->release_reqid(charon->kernel, reqid);
}
this->child_create->use_marks(this->child_create, this->child_create->use_marks(this->child_create,
this->child_sa->get_mark(this->child_sa, TRUE).value, this->child_sa->get_mark(this->child_sa, TRUE).value,
this->child_sa->get_mark(this->child_sa, FALSE).value); this->child_sa->get_mark(this->child_sa, FALSE).value);
@@ -282,8 +286,12 @@ METHOD(task_t, build_r, status_t,
} }
/* let the CHILD_CREATE task build the response */ /* let the CHILD_CREATE task build the response */
reqid = this->child_sa->get_reqid(this->child_sa); reqid = this->child_sa->get_reqid_ref(this->child_sa);
if (reqid)
{
this->child_create->use_reqid(this->child_create, reqid); this->child_create->use_reqid(this->child_create, reqid);
charon->kernel->release_reqid(charon->kernel, reqid);
}
this->child_create->use_marks(this->child_create, this->child_create->use_marks(this->child_create,
this->child_sa->get_mark(this->child_sa, TRUE).value, this->child_sa->get_mark(this->child_sa, TRUE).value,
this->child_sa->get_mark(this->child_sa, FALSE).value); this->child_sa->get_mark(this->child_sa, FALSE).value);
@@ -430,7 +438,7 @@ METHOD(task_t, process_i, status_t,
protocol = this->child_sa->get_protocol(this->child_sa); protocol = this->child_sa->get_protocol(this->child_sa);
child_cfg = this->child_sa->get_config(this->child_sa); child_cfg = this->child_sa->get_config(this->child_sa);
child_cfg->get_ref(child_cfg); child_cfg->get_ref(child_cfg);
args.reqid = this->child_sa->get_reqid(this->child_sa); args.reqid = this->child_sa->get_reqid_ref(this->child_sa);
args.label = this->child_sa->get_label(this->child_sa); args.label = this->child_sa->get_label(this->child_sa);
if (args.label) if (args.label)
{ {
@@ -440,6 +448,10 @@ METHOD(task_t, process_i, status_t,
this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi); this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
status = this->ike_sa->initiate(this->ike_sa, status = this->ike_sa->initiate(this->ike_sa,
child_cfg->get_ref(child_cfg), &args); child_cfg->get_ref(child_cfg), &args);
if (args.reqid)
{
charon->kernel->release_reqid(charon->kernel, args.reqid);
}
DESTROY_IF(args.label); DESTROY_IF(args.label);
return status; return status;
} }