← Back to branch summary

~ubuntu-branches/ubuntu/maverick/strongswan/maverick

« back to all changes in this revision

Viewing changes to src/charon/network/receiver.c

  • Committer: Bazaar Package Importer
  • Author(s): Rene Mayrhofer
  • Date: 2009-04-01 22:17:52 UTC
  • mfrom: (1.1.8 upstream)
  • Revision ID: james.westby@ubuntu.com-20090401221752-eozrk0ctabblo94z
http://bugs.debian.org/521950
* New upstream release, which incorporates the fix. Removed dpatch for it.
  Closes: #521950: CVE-2009-0790: DoS
* New support for EAP RADIUS authentication, enabled for this package.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/charon/network/receiver.c
1
1
/*
 
2
 * Copyright (C) 2008 Tobias Brunner
2
3
 * Copyright (C) 2005-2006 Martin Willi
3
4
 * Copyright (C) 2005 Jan Hutter
4
5
 * Hochschule fuer Technik Rapperswil
13
14
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
14
15
 * for more details.
15
16
 *
16
 
 * $Id: receiver.c 4228 2008-07-30 08:27:08Z martin $
 
17
 * $Id: receiver.c 4699 2008-11-26 09:22:19Z tobias $
17
18
 */
18
19
 
19
20
#include <stdlib.h>
34
35
#define COOKIE_LIFETIME 10
35
36
/** how many times to reuse the secret */
36
37
#define COOKIE_REUSE 10000
37
 
/** require cookies after half open IKE_SAs */
38
 
#define COOKIE_TRESHOLD 10
39
 
/** how many half open IKE_SAs per peer before blocking */
40
 
#define BLOCK_TRESHOLD 5
 
38
/** default value for private_receiver_t.cookie_threshold */
 
39
#define COOKIE_THRESHOLD_DEFAULT 10
 
40
/** default value for private_receiver_t.block_threshold */
 
41
#define BLOCK_THRESHOLD_DEFAULT 5
41
42
/** length of the secret to use for cookie calculation */
42
43
#define SECRET_LENGTH 16
43
44
 
98
99
        hasher_t *hasher;
99
100
        
100
101
        /**
101
 
         * use denial of service protection mechanisms (cookies)
102
 
         */
103
 
        bool dos_protection;
 
102
         * require cookies after this many half open IKE_SAs
 
103
         */
 
104
        u_int32_t cookie_threshold;
 
105
        
 
106
        /**
 
107
         * how many half open IKE_SAs per peer before blocking
 
108
         */
 
109
        u_int32_t block_threshold;
104
110
};
105
111
 
106
112
/**
204
210
        bool failed = FALSE;
205
211
                
206
212
        if (charon->ike_sa_manager->get_half_open_count(charon->ike_sa_manager,
207
 
                                                                                                        NULL) >= COOKIE_TRESHOLD)
 
213
                                                                                                NULL) >= this->cookie_threshold)
208
214
        {
209
215
                /* check for a cookie. We don't use our parser here and do it
210
216
                 * quick and dirty for performance reasons. 
211
 
                 * we assume to cookie is the first payload (which is a MUST), and 
212
 
                 * the cookies SPI length is zero. */
 
217
                 * we assume the cookie is the first payload (which is a MUST), and 
 
218
                 * the cookie's SPI length is zero. */
213
219
                packet_t *packet = message->get_packet(message);
214
220
                chunk_t data = packet->get_data(packet);
215
221
                if (data.len < 
242
248
static bool peer_to_aggressive(private_receiver_t *this, message_t *message)
243
249
{
244
250
        if (charon->ike_sa_manager->get_half_open_count(charon->ike_sa_manager,
245
 
                                                                message->get_source(message)) >= BLOCK_TRESHOLD)
 
251
                                                message->get_source(message)) >= this->block_threshold)
246
252
        {
247
253
                return TRUE;
248
254
        }
287
293
        }
288
294
        
289
295
        if (message->get_request(message) &&
290
 
                message->get_exchange_type(message) == IKE_SA_INIT &&
291
 
                this->dos_protection)
 
296
                message->get_exchange_type(message) == IKE_SA_INIT)
292
297
        {
293
298
                /* check for cookies */
294
 
                if (cookie_required(this, message))
 
299
                if (this->cookie_threshold && cookie_required(this, message))
295
300
                {
296
301
                        u_int32_t now = time(NULL);
297
302
                        chunk_t cookie = cookie_build(this, message, now - this->secret_offset,
319
324
                }
320
325
                
321
326
                /* check if peer has not too many IKE_SAs half open */
322
 
                if (peer_to_aggressive(this, message))
 
327
                if (this->block_threshold && peer_to_aggressive(this, message))
323
328
                {
324
329
                        DBG1(DBG_NET, "ignoring IKE_SA setup from %H, "
325
330
                                 "peer too aggressive", message->get_source(message));
373
378
        this->secret_used = 0;
374
379
        this->rng->get_bytes(this->rng, SECRET_LENGTH, this->secret);
375
380
        memcpy(this->secret_old, this->secret, SECRET_LENGTH);
376
 
        this->dos_protection = lib->settings->get_bool(lib->settings,
377
 
                                                                                                "charon.dos_protection", TRUE);
 
381
        this->cookie_threshold = lib->settings->get_int(lib->settings,
 
382
                                                                        "charon.cookie_threshold", COOKIE_THRESHOLD_DEFAULT);
 
383
        this->block_threshold = lib->settings->get_int(lib->settings,
 
384
                                                                        "charon.block_threshold", BLOCK_THRESHOLD_DEFAULT);
 
385
        if (!lib->settings->get_bool(lib->settings, "charon.dos_protection", TRUE))
 
386
        {
 
387
                this->cookie_threshold = 0;
 
388
                this->block_threshold = 0;
 
389
        }
378
390
 
379
391
        this->job = callback_job_create((callback_job_cb_t)receive_packets,
380
392
                                                                        this, NULL, NULL);