Attachment 151475 Details for Bug 234491 – Patch to allow racoon to ignore extra ACQUIRES from kernel.

[patch] Patch to allow racoon to ignore extra ACQUIRES from kernel.

patch.racoon.0329 (text/plain), 3.73 KB, created by Joy Latten on 2007-04-02 20:56:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Joy Latten

Created: 2007-04-02 20:56:34 UTC

Size: 3.73 KB

patch

obsolete

>diff -urpN ipsec-tools.orig/src/racoon/handler.h ipsec-tools/src/racoon/handler.h
>--- ipsec-tools.orig/src/racoon/handler.h	2007-03-29 00:06:25.000000000 -0500
>+++ ipsec-tools/src/racoon/handler.h	2007-03-29 00:45:38.000000000 -0500
>@@ -285,6 +285,7 @@ struct ph2handle {
> 	u_int8_t flags;			/* Flags for phase 2 */
> 	u_int32_t msgid;		/* msgid for phase 2 */
> 
>+	u_int32_t sa_count;		/* num of SAs sent in SADB_ADD */
> 	struct sainfo *sainfo;		/* place holder of sainfo */
> 	struct saprop *proposal;	/* SA(s) proposal. */
> 	struct saprop *approval;	/* SA(s) approved. */
>diff -urpN ipsec-tools.orig/src/racoon/pfkey.c ipsec-tools/src/racoon/pfkey.c
>--- ipsec-tools.orig/src/racoon/pfkey.c	2007-03-29 00:06:25.000000000 -0500
>+++ ipsec-tools/src/racoon/pfkey.c	2007-03-29 01:42:38.000000000 -0500
>@@ -1269,7 +1269,9 @@ pk_recvupdate(mhp)
> 	SCHED_KILL(iph2->sce);
> 	
> 	/* update status */
>-	iph2->status = PHASE2ST_ESTABLISHED;
>+	/* Do this in pk_recvadd 
>+	 * iph2->status = PHASE2ST_ESTABLISHED;
>+	 */
> 
> #ifdef ENABLE_STATS
> 	gettimeofday(&iph2->end, NULL);
>@@ -1306,7 +1308,8 @@ pk_sendadd(iph2)
> 	struct saproto *pr;
> 	int proxy = 0;
> 	struct pfkey_send_sa_args sa_args;
>-
>+	u_int32_t sa_sent = 0;
>+	
> 	/* sanity check */
> 	if (iph2->approval == NULL) {
> 		plog(LLV_ERROR, LOCATION, NULL,
>@@ -1422,6 +1425,9 @@ pk_sendadd(iph2)
> 			return -1;
> 		}
> 
>+		/* keep count of SAs added. */
>+		sa_sent++;
>+
> 		if (!lcconf->pathinfo[LC_PATHTYPE_BACKUPSA])
> 			continue;
> 
>@@ -1442,6 +1448,7 @@ pk_sendadd(iph2)
> 			sadbsecas2str(sa_args.src, sa_args.dst,
> 			sa_args.satype, sa_args.spi, sa_args.mode));
> 	}
>+	iph2->sa_count = sa_sent;
> 	return 0;
> }
> 
>@@ -1496,10 +1503,21 @@ pk_recvadd(mhp)
> 		return -1;
> 	}
> 
>-	/*
>-	 * NOTE don't update any status of phase2 handle
>-	 * because they must be updated by SADB_UPDATE message
>+	/* RFC 2367: An SADB_ADD message is also used when negotiation
>+	 * is finished, and the second of a pair of associations is added.
>+	 *
>+	 * Thus, update the status of phase 2 handle after all SADB_ADD
>+	 * msgs have been received for the handle, rather than
>+	 * after SADB_UPDATE.
>+	 *
>+	 * This also removes the possibilty of processing an ACQUIRE
>+	 * received by kernel for SAs we are still adding.
> 	 */
>+	if (iph2->sa_count) {
>+		iph2->sa_count = iph2->sa_count - 1;
>+		if (iph2->sa_count == 0)
>+			iph2->status = PHASE2ST_ESTABLISHED;
>+	}
> 
> 	plog(LLV_INFO, LOCATION, NULL,
> 		"IPsec-SA established: %s\n",
>@@ -1584,8 +1602,6 @@ pk_recvexpire(mhp)
> 	/* turn off the timer for calling isakmp_ph2expire() */ 
> 	SCHED_KILL(iph2->sce);
> 
>-	iph2->status = PHASE2ST_EXPIRED;
>-
> 	/* INITIATOR, begin phase 2 exchange. */
> 	/* allocate buffer for status management of pfkey message */
> 	if (iph2->side == INITIATOR) {
>@@ -1613,6 +1629,7 @@ pk_recvexpire(mhp)
> 	/* If not received SADB_EXPIRE, INITIATOR delete ph2handle. */
> 	/* RESPONDER always delete ph2handle, keep silent.  RESPONDER doesn't
> 	 * manage IPsec SA, so delete the list */
>+	iph2->status = PHASE2ST_EXPIRED;
> 	unbindph12(iph2);
> 	remph2(iph2);
> 	delph2(iph2);
>@@ -1734,8 +1751,18 @@ pk_recvacquire(mhp)
> 	 *    2. its state is equal to PHASE2ST_ESTABLISHED, then racoon
> 	 *       has to prcesss such a acquire message because racoon may
> 	 *       lost the expire message.
>+	 * 
>+	 * When in responder role, an spid doesn't get added to
>+	 * the handler since responder didn't receive acquire.
>+	 * Thus there is the case that a negotiation can be occurring
>+	 * and responder receives acquire for same policy. So to prevent
>+	 * another identical negotiation, also check by address.
> 	 */
>+
> 	iph2[0] = getph2byid(src, dst, xpl->sadb_x_policy_id);
>+	if (iph2[0] == NULL)
>+		iph2[0] = getph2bysaddr(src, dst);
>+
> 	if (iph2[0] != NULL) {
> 		if (iph2[0]->status < PHASE2ST_ESTABLISHED) {
> 			plog(LLV_DEBUG, LOCATION, NULL,

Actions: View | Diff

Attachments on bug 234491: 151475