diff options
| author | Martin Willi <martin@revosec.ch> | 2014-02-20 16:08:43 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2014-04-14 13:29:49 +0200 |
| commit | 8503077175cd04f24cde25f663b0df9969f3b578 (patch) | |
| tree | 814df597a597c7155e4d24739b5f7ccd3e2321fa /src/libcharon/sa | |
| parent | abd7d3be9ca88168dbf7837ea906ed788e5a0e94 (diff) | |
| download | strongswan-8503077175cd04f24cde25f663b0df9969f3b578.tar.bz2 strongswan-8503077175cd04f24cde25f663b0df9969f3b578.tar.xz | |
ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs
Prevents a responder peer to trick us into established state by starting
IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH.
Fixes CVE-2014-2338.
Diffstat (limited to 'src/libcharon/sa')
| -rw-r--r-- | src/libcharon/sa/ikev2/task_manager_v2.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c index ac3be900f..a5252ab70 100644 --- a/src/libcharon/sa/ikev2/task_manager_v2.c +++ b/src/libcharon/sa/ikev2/task_manager_v2.c @@ -778,6 +778,15 @@ static status_t process_request(private_task_manager_t *this, case CREATE_CHILD_SA: { /* FIXME: we should prevent this on mediation connections */ bool notify_found = FALSE, ts_found = FALSE; + + if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || + this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) + { + DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " + "unestablished IKE_SA, rejected"); + return FAILED; + } + enumerator = message->create_payload_enumerator(message); while (enumerator->enumerate(enumerator, &payload)) { |