denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Only accept initial messages in specific states

Browse Source 
The previous code allowed an attacker to slip in an IKE_SA_INIT with
both SPIs and MID 1 set when an IKE_AUTH would be expected instead.

References #816.
This commit is contained in:
Tobias Brunner
2015-03-04 13:47:53 +01:00
parent 650a3ad515
commit dd0ebb5483
1 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/task_manager_v2.c
+8 -9
View File
@@ -1304,18 +1304,17 @@ METHOD(task_manager_t, process_message, status_t,
{ {
if (mid == this->responding.mid) if (mid == this->responding.mid)
{ {
/* reject initial messages once established */ /* reject initial messages if not received in specific states */
if (msg->get_exchange_type(msg) == IKE_SA_INIT || if ((msg->get_exchange_type(msg) == IKE_SA_INIT &&
msg->get_exchange_type(msg) == IKE_AUTH) this->ike_sa->get_state(this->ike_sa) != IKE_CREATED) ||
(msg->get_exchange_type(msg) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING))
{ {
if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED && DBG1(DBG_IKE, "ignoring %N in IKE_SA state %N",
this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING) exchange_type_names, msg->get_exchange_type(msg),
{ ike_sa_state_names, this->ike_sa->get_state(this->ike_sa));
DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
exchange_type_names, msg->get_exchange_type(msg));
return FAILED; return FAILED;
} }
}
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE)) if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
{ /* with MOBIKE, we do no implicit updates */ { /* with MOBIKE, we do no implicit updates */
this->ike_sa->update_hosts(this->ike_sa, me, other, mid == 1); this->ike_sa->update_hosts(this->ike_sa, me, other, mid == 1);