denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-init: Fix key derivation if SA is reset after IKE_INTERMEDIATE retransmits

Browse Source 
Because the `derived` flag was not reset (it's set after the initial
IKE_SA_INIT exchange), no keys would get derived when sending
IKE_INTERMEDIATE during the next try.  As there is then no `aead_t`
available, encrypting the message would fail and the initiation would
remain stuck.

Fixes: 0d49ddec2e ("ike-init: Add support for multiple key exchanges")
This commit is contained in:
Tobias Brunner
2026-05-22 14:33:28 +02:00
parent 18a94525a7
commit dc8b479eb8
1 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_init.c
+1 -8
View File
@@ -600,14 +600,7 @@ static bool additional_key_exchange_required(private_ike_init_t *this)
*/
static void clear_key_exchanges(private_ike_init_t *this)
{
int i;
for (i = 0; i < MAX_KEY_EXCHANGES; i++)
{
this->key_exchanges[i].type = 0;
this->key_exchanges[i].method = 0;
this->key_exchanges[i].done = FALSE;
}
memset(this->key_exchanges, 0, sizeof(this->key_exchanges));
this->ke_index = 0;
array_destroy_offset(this->kes, offsetof(key_exchange_t, destroy));