From d8c7fe063491e7c5af564c5e391bed6e003a247f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 24 Jun 2026 11:43:47 +0200 Subject: [PATCH] connect-manager: Ignore connectivity checks for incomplete checklists This could cause a crash due to signature verification with missing key (although, memcpy() likely just returns with length 0), but it also makes the signature predictable as the key is omitted. Fixes: d5cc1758332e ("experimental P2P-NAT-T for IKEv2 merged back from branch") --- src/libcharon/sa/ikev2/connect_manager.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/libcharon/sa/ikev2/connect_manager.c b/src/libcharon/sa/ikev2/connect_manager.c index 79a4a766f..63f20c493 100644 --- a/src/libcharon/sa/ikev2/connect_manager.c +++ b/src/libcharon/sa/ikev2/connect_manager.c @@ -1398,6 +1398,14 @@ METHOD(connect_manager_t, process_check, void, this->mutex->unlock(this->mutex); return; } + if (checklist->state == CHECK_NONE) + { + DBG1(DBG_IKE, "checklist with id '%#B' not ready yet", + &check->connect_id); + check_destroy(check); + this->mutex->unlock(this->mutex); + return; + } chunk_t sig = build_signature(this, checklist, check, FALSE); if (!chunk_equals(sig, check->auth))