denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

connect-manager: Ignore connectivity checks for incomplete checklists

Browse Source 
This could cause a crash due to signature verification with missing
key (although, memcpy() likely just returns with length 0), but it
also makes the signature predictable as the key is omitted.

Fixes: d5cc175833 ("experimental P2P-NAT-T for IKEv2 merged back from branch")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:36 +02:00
parent dd94e8d70e
commit d8c7fe0634
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/connect_manager.c
+8
View File
@@ -1398,6 +1398,14 @@ METHOD(connect_manager_t, process_check, void,
this->mutex->unlock(this->mutex); this->mutex->unlock(this->mutex);
return; return;
} }
if (checklist->state == CHECK_NONE)
{
DBG1(DBG_IKE, "checklist with id '%#B' not ready yet",
&check->connect_id);
check_destroy(check);
this->mutex->unlock(this->mutex);
return;
}
chunk_t sig = build_signature(this, checklist, check, FALSE); chunk_t sig = build_signature(this, checklist, check, FALSE);
if (!chunk_equals(sig, check->auth)) if (!chunk_equals(sig, check->auth))