diff options
| author |   Atzm Watanabe <atzmism@gmail.com> | 2022-08-09 14:00:03 +0900 |
|---|---|---|
| committer |   Beno�t Ganne <bganne@cisco.com> | 2022-08-10 07:44:55 +0000 |
| commit | 7e6ffba672875f1070348753890d023695d73be6 (patch) | |
| tree | d231716d946b016d1051fd05db6bfab5e021d04d /src/plugins/ikev2 | |
| parent | 5c7e579f77833537e27a265295773378835d4500 (diff) | |
ikev2: do not accept rekey until old SA is deleted
Type: fix
Signed-off-by: Atzm Watanabe <atzmism@gmail.com>
Change-Id: I11b6107492004a45104857dc2dae01b9a5a01e3b
Diffstat (limited to 'src/plugins/ikev2')
| -rw-r--r-- | src/plugins/ikev2/ikev2.c | 49 | ||||
| -rw-r--r-- | src/plugins/ikev2/ikev2_priv.h | 1 |
2 files changed, 36 insertions, 14 deletions
diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c index 20be89e1aaf..f8b9c6fb04b 100644 --- a/src/plugins/ikev2/ikev2.c +++ b/src/plugins/ikev2/ikev2.c @@ -1463,6 +1463,7 @@ ikev2_process_create_child_sa_req (vlib_main_t * vm, rekey = sa->rekey; if (vec_len (rekey) == 0) goto cleanup_and_exit; + rekey->notify_type = 0; rekey->protocol_id = proposal->protocol_id; rekey->i_proposal = ikev2_select_proposal (proposal, IKEV2_PROTOCOL_ESP); @@ -1491,22 +1492,34 @@ ikev2_process_create_child_sa_req (vlib_main_t * vm, goto cleanup_and_exit; } vec_add2 (sa->rekey, rekey, 1); + rekey->notify_type = 0; rekey->protocol_id = n->protocol_id; rekey->spi = n->spi; - rekey->i_proposal = proposal; - rekey->r_proposal = - ikev2_select_proposal (proposal, IKEV2_PROTOCOL_ESP); - /* update Ni */ - vec_reset_length (sa->i_nonce); - vec_add (sa->i_nonce, nonce, nonce_len); - /* generate new Nr */ - vec_validate (sa->r_nonce, nonce_len - 1); - RAND_bytes ((u8 *) sa->r_nonce, nonce_len); + if (sa->old_remote_id_present) + { + rekey->notify_type = IKEV2_NOTIFY_MSG_TEMPORARY_FAILURE; + vec_free (proposal); + vec_free (tsr); + vec_free (tsi); + } + else + { + rekey->i_proposal = proposal; + rekey->r_proposal = + ikev2_select_proposal (proposal, IKEV2_PROTOCOL_ESP); + /* update Ni */ + vec_reset_length (sa->i_nonce); + vec_add (sa->i_nonce, nonce, nonce_len); + /* generate new Nr */ + vec_validate (sa->r_nonce, nonce_len - 1); + RAND_bytes ((u8 *) sa->r_nonce, nonce_len); + } } else { /* create new child SA */ vec_add2 (sa->new_child, rekey, 1); + rekey->notify_type = 0; rekey->i_proposal = proposal; rekey->r_proposal = ikev2_select_proposal (proposal, IKEV2_PROTOCOL_ESP); @@ -2555,10 +2568,17 @@ ikev2_generate_message (vlib_buffer_t *b, ikev2_sa_t *sa, ike_header_t *ike, } else if (vec_len (sa->rekey) > 0) { - ikev2_payload_add_sa (chain, sa->rekey[0].r_proposal); - ikev2_payload_add_nonce (chain, sa->r_nonce); - ikev2_payload_add_ts (chain, sa->rekey[0].tsi, IKEV2_PAYLOAD_TSI); - ikev2_payload_add_ts (chain, sa->rekey[0].tsr, IKEV2_PAYLOAD_TSR); + if (sa->rekey[0].notify_type) + ikev2_payload_add_notify (chain, sa->rekey[0].notify_type, 0); + else + { + ikev2_payload_add_sa (chain, sa->rekey[0].r_proposal); + ikev2_payload_add_nonce (chain, sa->r_nonce); + ikev2_payload_add_ts (chain, sa->rekey[0].tsi, + IKEV2_PAYLOAD_TSI); + ikev2_payload_add_ts (chain, sa->rekey[0].tsr, + IKEV2_PAYLOAD_TSR); + } vec_del1 (sa->rekey, 0); } else if (vec_len (sa->new_child) > 0) @@ -3320,7 +3340,8 @@ ikev2_node_internal (vlib_main_t *vm, vlib_node_runtime_t *node, if (sa0->rekey) { - if (sa0->rekey[0].protocol_id != IKEV2_PROTOCOL_IKE) + if (!sa0->rekey[0].notify_type && + sa0->rekey[0].protocol_id != IKEV2_PROTOCOL_IKE) { if (sa0->childs) ikev2_sa_free_all_child_sa (&sa0->childs); diff --git a/src/plugins/ikev2/ikev2_priv.h b/src/plugins/ikev2/ikev2_priv.h index 0a6036891b2..379b68dbdfc 100644 --- a/src/plugins/ikev2/ikev2_priv.h +++ b/src/plugins/ikev2/ikev2_priv.h @@ -312,6 +312,7 @@ typedef struct typedef struct { + u16 notify_type; u8 protocol_id; u32 spi; u32 ispi; |