denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check if colliding rekey actually created an IKE_INIT

Browse Source 
In some cases (especially if a child is half-open) the colliding
rekey-job might not have created the ike_init member. If so, the
nonce check fails with SIGSEGV.
This commit is contained in:
Thomas Egerer
2010-08-25 10:16:42 +02:00
committed by Martin Willi
parent 8427c78611
commit e54e86cb49
1 changed files with 42 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/tasks/ike_rekey.c
+42 -37
View File
@@ -241,51 +241,56 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
if (this->collision && if (this->collision &&
this->collision->get_type(this->collision) == IKE_REKEY) this->collision->get_type(this->collision) == IKE_REKEY)
{ {
chunk_t this_nonce, other_nonce;
host_t *host;
private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision; private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
this_nonce = this->ike_init->get_lower_nonce(this->ike_init); /* ike_init can be NULL, if child_sa is half-open */
other_nonce = other->ike_init->get_lower_nonce(other->ike_init); if (other->ike_init)
{
host_t *host;
chunk_t this_nonce, other_nonce;
/* if we have the lower nonce, delete rekeyed SA. If not, delete this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
* the redundant. */ other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
if (memcmp(this_nonce.ptr, other_nonce.ptr,
min(this_nonce.len, other_nonce.len)) < 0) /* if we have the lower nonce, delete rekeyed SA. If not, delete
{ * the redundant. */
/* peer should delete this SA. Add a timeout just in case. */ if (memcmp(this_nonce.ptr, other_nonce.ptr,
job_t *job = (job_t*)delete_ike_sa_job_create( min(this_nonce.len, other_nonce.len)) < 0)
other->new_sa->get_id(other->new_sa), TRUE);
charon->scheduler->schedule_job(charon->scheduler, job, 10);
DBG1(DBG_IKE, "IKE_SA rekey collision won, deleting rekeyed IKE_SA");
charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
other->new_sa = NULL;
}
else
{
DBG1(DBG_IKE, "IKE_SA rekey collision lost, deleting redundant IKE_SA");
/* apply host for a proper delete */
host = this->ike_sa->get_my_host(this->ike_sa);
this->new_sa->set_my_host(this->new_sa, host->clone(host));
host = this->ike_sa->get_other_host(this->ike_sa);
this->new_sa->set_other_host(this->new_sa, host->clone(host));
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
{ {
charon->ike_sa_manager->checkin_and_destroy( /* peer should delete this SA. Add a timeout just in case. */
charon->ike_sa_manager, this->new_sa); job_t *job = (job_t*)delete_ike_sa_job_create(
other->new_sa->get_id(other->new_sa), TRUE);
charon->scheduler->schedule_job(charon->scheduler, job, 10);
DBG1(DBG_IKE, "IKE_SA rekey collision won, deleting rekeyed IKE_SA");
charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
other->new_sa = NULL;
} }
else else
{ {
charon->ike_sa_manager->checkin( DBG1(DBG_IKE, "IKE_SA rekey collision lost, deleting redundant IKE_SA");
charon->ike_sa_manager, this->new_sa); /* apply host for a proper delete */
host = this->ike_sa->get_my_host(this->ike_sa);
this->new_sa->set_my_host(this->new_sa, host->clone(host));
host = this->ike_sa->get_other_host(this->ike_sa);
this->new_sa->set_other_host(this->new_sa, host->clone(host));
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
{
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, this->new_sa);
}
else
{
charon->ike_sa_manager->checkin(
charon->ike_sa_manager, this->new_sa);
}
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
/* inherit to other->new_sa in destroy() */
this->new_sa = other->new_sa;
other->new_sa = NULL;
return SUCCESS;
} }
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
/* inherit to other->new_sa in destroy() */
this->new_sa = other->new_sa;
other->new_sa = NULL;
return SUCCESS;
} }
/* set threads active IKE_SA after checkin */ /* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa); charon->bus->set_sa(charon->bus, this->ike_sa);