denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libipsec: check for a policy with the reqid of the SA on decapsulation

Browse Source 
To prevent a client from sending a packet with a source address of a different
client, we require a policy bound via reqid to the decapsulating SA.
This commit is contained in:
Martin Willi
2013-09-13 13:56:43 +02:00
parent 791fde1669
commit 96136a1229
3 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libipsec/ipsec_policy_mgr.c
+7 -3
View File
@@ -230,7 +230,8 @@ METHOD(ipsec_policy_mgr_t, flush_policies, status_t,
}
METHOD(ipsec_policy_mgr_t, find_by_packet, ipsec_policy_t*,
private_ipsec_policy_mgr_t *this, ip_packet_t *packet, bool inbound)
private_ipsec_policy_mgr_t *this, ip_packet_t *packet, bool inbound,
u_int32_t reqid)
{
enumerator_t *enumerator;
ipsec_policy_entry_t *current;
@@ -245,8 +246,11 @@ METHOD(ipsec_policy_mgr_t, find_by_packet, ipsec_policy_t*,
if ((inbound == (policy->get_direction(policy) == POLICY_IN)) &&
policy->match_packet(policy, packet))
{
found = policy->get_ref(policy);
break;
if (reqid == 0 || reqid == policy->get_reqid(policy))
{
found = policy->get_ref(policy);
break;
}
}
}
enumerator->destroy(enumerator);
src/libipsec/ipsec_policy_mgr.h
+3 -1
View File
@@ -97,10 +97,12 @@ struct ipsec_policy_mgr_t {
*
* @param packet IP packet to match
* @param inbound TRUE for an inbound packet
* @param reqid require a policy with a specific reqid, 0 for any
* @return reference to the policy, or NULL if none found
*/
ipsec_policy_t *(*find_by_packet)(ipsec_policy_mgr_t *this,
ip_packet_t *packet, bool inbound);
ip_packet_t *packet, bool inbound,
u_int32_t reqid);
/**
* Destroy an ipsec_policy_mgr_t
src/libipsec/ipsec_processor.c
+4 -3
View File
@@ -93,7 +93,7 @@ static job_requeue_t process_inbound(private_ipsec_processor_t *this)
esp_packet_t *packet;
ipsec_sa_t *sa;
u_int8_t next_header;
u_int32_t spi;
u_int32_t spi, reqid;
packet = (esp_packet_t*)this->inbound_queue->dequeue(this->inbound_queue);
@@ -126,6 +126,7 @@ static job_requeue_t process_inbound(private_ipsec_processor_t *this)
packet->destroy(packet);
return JOB_REQUEUE_DIRECT;
}
reqid = sa->get_reqid(sa);
ipsec->sas->checkin(ipsec->sas, sa);
next_header = packet->get_next_header(packet);
@@ -139,7 +140,7 @@ static job_requeue_t process_inbound(private_ipsec_processor_t *this)
ip_packet = packet->get_payload(packet);
policy = ipsec->policies->find_by_packet(ipsec->policies,
ip_packet, TRUE);
ip_packet, TRUE, reqid);
if (policy)
{ /* TODO-IPSEC: update policy/sa stats? */
deliver_inbound(this, packet);
@@ -193,7 +194,7 @@ static job_requeue_t process_outbound(private_ipsec_processor_t *this)
packet = (ip_packet_t*)this->outbound_queue->dequeue(this->outbound_queue);
policy = ipsec->policies->find_by_packet(ipsec->policies, packet, FALSE);
policy = ipsec->policies->find_by_packet(ipsec->policies, packet, FALSE, 0);
if (!policy)
{
DBG2(DBG_ESP, "no matching outbound IPsec policy for %H == %H",