denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed segfault in pluto with multiple ISAKMP SAs in delete payload

Browse Source
This commit is contained in:
Heiko Hund
2010-04-20 21:23:05 +02:00
committed by Andreas Steffen
parent 4590260b2d
commit d0f1b3b96f
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/ipsec_doi.c
+20 -2
View File
@@ -702,6 +702,8 @@ void accept_delete(struct state *st, struct msg_digest *md,
struct payload_digest *p) struct payload_digest *p)
{ {
struct isakmp_delete *d = &(p->payload.delete); struct isakmp_delete *d = &(p->payload.delete);
identification_t *this_id, *that_id;
ip_address peer_addr;
size_t sizespi; size_t sizespi;
int i; int i;
@@ -759,6 +761,15 @@ void accept_delete(struct state *st, struct msg_digest *md,
return; return;
} }
if (d->isad_protoid == PROTO_ISAKMP)
{
struct end *this = &st->st_connection->spd.this;
struct end *that = &st->st_connection->spd.that;
this_id = this->id->clone(this->id);
that_id = that->id->clone(that->id);
peer_addr = st->st_connection->spd.that.host_addr;
}
for (i = 0; i < d->isad_nospi; i++) for (i = 0; i < d->isad_nospi; i++)
{ {
u_char *spi = p->pbs.cur + (i * sizespi); u_char *spi = p->pbs.cur + (i * sizespi);
@@ -770,7 +781,7 @@ void accept_delete(struct state *st, struct msg_digest *md,
*/ */
struct state *dst = find_state(spi /*iCookie*/ struct state *dst = find_state(spi /*iCookie*/
, spi+COOKIE_SIZE /*rCookie*/ , spi+COOKIE_SIZE /*rCookie*/
, &st->st_connection->spd.that.host_addr , &peer_addr
, MAINMODE_MSGID); , MAINMODE_MSGID);
if (dst == NULL) if (dst == NULL)
@@ -778,7 +789,8 @@ void accept_delete(struct state *st, struct msg_digest *md,
loglog(RC_LOG_SERIOUS, "ignoring Delete SA payload: " loglog(RC_LOG_SERIOUS, "ignoring Delete SA payload: "
"ISAKMP SA not found (maybe expired)"); "ISAKMP SA not found (maybe expired)");
} }
else if (!same_peer_ids(st->st_connection, dst->st_connection, NULL)) else if (! this_id->equals(this_id, dst->st_connection->spd.this.id) ||
! that_id->equals(that_id, dst->st_connection->spd.that.id))
{ {
/* we've not authenticated the relevant identities */ /* we've not authenticated the relevant identities */
loglog(RC_LOG_SERIOUS, "ignoring Delete SA payload: " loglog(RC_LOG_SERIOUS, "ignoring Delete SA payload: "
@@ -876,6 +888,12 @@ void accept_delete(struct state *st, struct msg_digest *md,
} }
} }
} }
if (d->isad_protoid == PROTO_ISAKMP)
{
this_id->destroy(this_id);
that_id->destroy(that_id);
}
} }
/* The whole message must be a multiple of 4 octets. /* The whole message must be a multiple of 4 octets.