Check if colliding rekey actually created an IKE_INIT
In some cases (especially if a child is half-open) the colliding rekey-job might not have created the ike_init member. If so, the nonce check fails with SIGSEGV.
This commit is contained in:
committed by
Martin Willi
parent
8427c78611
commit
e54e86cb49
@@ -241,10 +241,14 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
|
|||||||
if (this->collision &&
|
if (this->collision &&
|
||||||
this->collision->get_type(this->collision) == IKE_REKEY)
|
this->collision->get_type(this->collision) == IKE_REKEY)
|
||||||
{
|
{
|
||||||
chunk_t this_nonce, other_nonce;
|
|
||||||
host_t *host;
|
|
||||||
private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
|
private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
|
||||||
|
|
||||||
|
/* ike_init can be NULL, if child_sa is half-open */
|
||||||
|
if (other->ike_init)
|
||||||
|
{
|
||||||
|
host_t *host;
|
||||||
|
chunk_t this_nonce, other_nonce;
|
||||||
|
|
||||||
this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
|
this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
|
||||||
other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
|
other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
|
||||||
|
|
||||||
@@ -287,6 +291,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
|
|||||||
other->new_sa = NULL;
|
other->new_sa = NULL;
|
||||||
return SUCCESS;
|
return SUCCESS;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
/* set threads active IKE_SA after checkin */
|
/* set threads active IKE_SA after checkin */
|
||||||
charon->bus->set_sa(charon->bus, this->ike_sa);
|
charon->bus->set_sa(charon->bus, this->ike_sa);
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user