From 09d4497536f8977c452a998642e5af1ece8cc5e4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 25 Jun 2018 12:23:50 +0200 Subject: [PATCH] ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH The AUTH payload check in build_certs() should be fine, but add some extra checks just to make really sure and also for clarification. --- src/libcharon/sa/ikev2/tasks/ike_cert_post.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c index 3c4be6e73e..3f821842fc 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c +++ b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c @@ -255,8 +255,10 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message) METHOD(task_t, build_i, status_t, private_ike_cert_post_t *this, message_t *message) { - build_certs(this, message); - + if (message->get_exchange_type(message) == IKE_AUTH) + { + build_certs(this, message); + } return NEED_MORE; } @@ -269,8 +271,10 @@ METHOD(task_t, process_r, status_t, METHOD(task_t, build_r, status_t, private_ike_cert_post_t *this, message_t *message) { - build_certs(this, message); - + if (message->get_exchange_type(message) == IKE_AUTH) + { + build_certs(this, message); + } if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED) { /* stay alive, we might have additional rounds with certs */ return NEED_MORE; -- 2.47.2