denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: Accept Quick Mode DELETES while Quick Mode rekeying is active

Browse Source 
If a peer immediately sends DELETE messages when completing Quick Mode rekeying,
the third Quick Mode message and the DELETE are sent simultaneously. This
implies that DELETE messages may arrive before the completing third Quick Mode
message.

Handle this case by ignoring the DELETE INFORMATIONAL in Quick Mode and let
the delete task handle it.
This commit is contained in:
Martin Willi
2014-08-25 09:53:02 +02:00
parent 11bf11c1f5
commit cd9bba508b
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/quick_mode.c
+21 -2
View File
@@ -1117,11 +1117,22 @@ METHOD(task_t, process_r, status_t,
}
case QM_NEGOTIATED:
{
if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
has_notify_errors(this, message))
if (has_notify_errors(this, message))
{
return SUCCESS;
}
if (message->get_exchange_type(message) == INFORMATIONAL_V1)
{
if (message->get_payload(message, PLV1_DELETE))
{
/* If the DELETE for a Quick Mode follows immediately
* after rekeying, we might receive it before the
* third completing Quick Mode message. Ignore it, as
* it gets handled by a separately queued delete task. */
return NEED_MORE;
}
return SUCCESS;
}
if (!install(this))
{
ike_sa_t *ike_sa = this->ike_sa;
@@ -1198,6 +1209,14 @@ METHOD(task_t, build_r, status_t,
this->state = QM_NEGOTIATED;
return NEED_MORE;
}
case QM_NEGOTIATED:
if (message->get_exchange_type(message) == INFORMATIONAL_V1)
{
/* skip INFORMATIONAL response if we received a INFORMATIONAL
* delete, see process_r() */
return ALREADY_DONE;
}
/* fall */
default:
return FAILED;
}