File 0011-ikev1-Don-t-retransmit-Aggressive-Mode-res... of Package strongswan

Overview Repositories Revisions Requests Users Attributes Meta

File 0011-ikev1-Don-t-retransmit-Aggressive-Mode-response.patch of Package strongswan (Revision dc97a3ff1b21c7b9fbcaf59e7e2a67e7)

Currently displaying revision dc97a3ff1b21c7b9fbcaf59e7e2a67e7 , Show latest

From 4e16732c1c668c27e73574724d2d90537a74f67a Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 17 Jun 2016 18:19:48 +0200
Subject: [PATCH] ikev1: Don't retransmit Aggressive Mode response

These could theoretically be used for an amplified DDoS attack.
---
 src/libcharon/sa/ikev1/task_manager_v1.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c
index b0c4f5f84..7964fbe9e 100644
--- a/src/libcharon/sa/ikev1/task_manager_v1.c
+++ b/src/libcharon/sa/ikev1/task_manager_v1.c
@@ -743,8 +743,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
 				continue;
 			case NEED_MORE:
 				/* processed, but task needs another exchange */
-				if (task->get_type(task) == TASK_QUICK_MODE ||
-					task->get_type(task) == TASK_AGGRESSIVE_MODE)
+				if (task->get_type(task) == TASK_QUICK_MODE)
 				{	/* we rely on initiator retransmission, except for
 					 * three-message exchanges */
 					expect_request = TRUE;
-- 
2.12.2

Places

File 0011-ikev1-Don-t-retransmit-Aggressive-Mode-response.patch of Package strongswan (Revision dc97a3ff1b21c7b9fbcaf59e7e2a67e7)

Places