rpms/libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

pluto: fix refcounting of whack FD at CREATE_CHILD_SA request

Browse Source 
Resolves: RHEL-61461
Signed-off-by: Daiki Ueno <dueno@redhat.com>
This commit is contained in:
Daiki Ueno 2024-11-12 14:27:13 +09:00
parent 656f1c566f
commit d1c9c2a2c9
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
libreswan-4.15-whack-fd-refcount.patch Normal file
View File

@ -0,0 +1,32 @@
From b09f6edd9148cb08d70f8bad604efa064c9188e0 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Mon, 21 Oct 2024 09:25:06 +0900
Subject: [PATCH] pluto: fix refcounting of whack FD at CREATE_CHILD_SA request
After commit 6341e0d0257f26a7883bc5d1abff50ac362c625b, whack FD copied
to a larval Child SA in submit_v2_CREATE_CHILD_SA_new_child is not
properly closed at the completion of the CREATE_CHILD_SA exchange, as
new_v2_child_state increases the reference count of the whack FD
before sharing it with the IKE SA.
Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
programs/pluto/ikev2_create_child_sa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/programs/pluto/ikev2_create_child_sa.c b/programs/pluto/ikev2_create_child_sa.c
index 034266e7a6..951485d063 100644
--- a/programs/pluto/ikev2_create_child_sa.c
+++ b/programs/pluto/ikev2_create_child_sa.c
@@ -710,7 +710,7 @@ void submit_v2_CREATE_CHILD_SA_new_child(struct ike_sa *ike,
struct child_sa *larval_child = new_v2_child_state(c, ike, IPSEC_SA,
SA_INITIATOR,
STATE_V2_NEW_CHILD_I0,
- whackfd);
+ null_fd);
free_chunk_content(&larval_child->sa.st_ni); /* this is from the parent. */
free_chunk_content(&larval_child->sa.st_nr); /* this is from the parent. */
--
2.47.0

6
libreswan.spec
View File

@ -31,7 +31,7 @@ Name: libreswan
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
# version is generated in the release script
Version: 4.15
Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
Release: %{?prever:0.}4%{?prever:.%{prever}}%{?dist}
License: GPLv2
Url: https://libreswan.org/
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
@ -43,6 +43,7 @@ Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
Patch: libreswan-4.15-ondemand-tcp.patch
Patch: libreswan-4.15-netlink-extack.patch
Patch: libreswan-4.15-whack-fd-refcount.patch
BuildRequires: audit-libs-devel
BuildRequires: bison
@ -198,6 +199,9 @@ certutil -N -d sql:$tmpdir --empty-password
%doc %{_mandir}/*/*
%changelog
* Tue Nov 12 2024 Daiki Ueno <dueno@redhat.com> - 4.15-4
- pluto: fix refcounting of whack FD at CREATE_CHILD_SA request (RHEL-61461)
* Tue Aug 6 2024 Daiki Ueno <dueno@redhat.com> - 4.15-3
- Fix release number