From 68b3ece719ea3da50c0a3543f47ffd65dbfbeaf1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 25 Jun 2018 12:23:50 +0200 Subject: [PATCH] ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH The AUTH payload check should be fine, but add some extra checks just to make really sure and also for clarification. --- src/libcharon/sa/ikev2/tasks/ike_cert_post.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c index 68af6e35bc..003cc72f3d 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c +++ b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c @@ -241,8 +241,10 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message) METHOD(task_t, build_i, status_t, private_ike_cert_post_t *this, message_t *message) { - build_certs(this, message); - + if (message->get_exchange_type(message) == IKE_AUTH) + { + build_certs(this, message); + } return NEED_MORE; } @@ -255,8 +257,10 @@ METHOD(task_t, process_r, status_t, METHOD(task_t, build_r, status_t, private_ike_cert_post_t *this, message_t *message) { - build_certs(this, message); - + if (message->get_exchange_type(message) == IKE_AUTH) + { + build_certs(this, message); + } if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED) { /* stay alive, we might have additional rounds with certs */ return NEED_MORE; -- 2.47.2