denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mem-pool: Fix issue with make-before-break reauth and multiple IKE_SAs

Browse Source 
If uniqueness checks are disabled and multiple IKE_SAs with the same
identities are created, an offline lease could have gotten reassigned
during a make-before-break reauthentication if such an SA was closed
earlier.  Checking for an online lease for the same client (IP/port)
first ensures that the correct IP is reassigned during the
reauthentication.

References strongswan/strongswan#2472
This commit is contained in:
Tobias Brunner
2024-10-25 14:52:46 +02:00
parent f09b8203d3
commit d4a0dd9f93
1 changed files with 25 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/attributes/mem_pool.c
+20 -19
View File
@@ -287,26 +287,10 @@ static int get_existing(private_mem_pool_t *this, identification_t *id,
return 0;
}
/* check for a valid offline lease, refresh */
enumerator = array_create_enumerator(entry->offline);
if (enumerator->enumerate(enumerator, &current))
if (peer)
{
reassign.offset = offset = *current;
reassign.hash = hash_addr(peer);
array_insert(entry->online, ARRAY_TAIL, &reassign);
array_remove_at(entry->offline, enumerator);
}
enumerator->destroy(enumerator);
if (offset)
{
DBG1(DBG_CFG, "reassigning offline lease to '%Y'", id);
return offset;
}
if (!peer)
{
return 0;
}
/* check for a valid online lease to reassign */
/* check for a valid online lease to reassign during make-before-break
* reauthentication */
enumerator = array_create_enumerator(entry->online);
while (enumerator->enumerate(enumerator, &lease))
{
@@ -324,6 +308,23 @@ static int get_existing(private_mem_pool_t *this, identification_t *id,
if (offset)
{
DBG1(DBG_CFG, "reassigning online lease to '%Y'", id);
return offset;
}
}
/* check for a valid offline lease, refresh */
enumerator = array_create_enumerator(entry->offline);
if (enumerator->enumerate(enumerator, &current))
{
reassign.offset = offset = *current;
reassign.hash = hash_addr(peer);
array_insert(entry->online, ARRAY_TAIL, &reassign);
array_remove_at(entry->offline, enumerator);
}
enumerator->destroy(enumerator);
if (offset)
{
DBG1(DBG_CFG, "reassigning offline lease to '%Y'", id);
}
return offset;
}