From e7c228512b084de2860b1d5c7610a810a86d3361 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 12 Nov 2024 14:28:06 +0900 Subject: [PATCH] pluto: ignore CREATE_CHILD_SA request if crypto is in progress Resolves: RHEL-61461 Signed-off-by: Daiki Ueno --- ...-4.15-create-child-sa-race-condition.patch | 57 +++++++++++++++++++ libreswan.spec | 2 + 2 files changed, 59 insertions(+) create mode 100644 libreswan-4.15-create-child-sa-race-condition.patch diff --git a/libreswan-4.15-create-child-sa-race-condition.patch b/libreswan-4.15-create-child-sa-race-condition.patch new file mode 100644 index 0000000..99f7e3e --- /dev/null +++ b/libreswan-4.15-create-child-sa-race-condition.patch @@ -0,0 +1,57 @@ +From d0a468bc4ca54b3aa941f522afd4ef8ed279e3cd Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Tue, 22 Oct 2024 07:53:20 +0900 +Subject: [PATCH] pluto: ignore CREATE_CHILD_SA request if crypto is in + progress + +Since commit 1f4cede653c865d84ea4dd045db05670d513d385, both initiator +and responder drive CREATE_CHILD_SA processing with the same shared +IKE SA, which may sometimes interleave. This adds a guard at the +entry to the responder code, to return STF_IGNORE in case any CRYPTO +continuation is already in place, so that the initiator could +retransmit after a timeout on their side. + +Signed-off-by: Daiki Ueno +--- + programs/pluto/ikev2_create_child_sa.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/programs/pluto/ikev2_create_child_sa.c b/programs/pluto/ikev2_create_child_sa.c +index 951485d063..504fc58a6b 100644 +--- a/programs/pluto/ikev2_create_child_sa.c ++++ b/programs/pluto/ikev2_create_child_sa.c +@@ -662,6 +662,15 @@ stf_status process_v2_CREATE_CHILD_SA_rekey_child_request(struct ike_sa *ike, + struct child_sa *larval_child, + struct msg_digest *md) + { ++ /* ++ * CRYPTO continuation is ongoing as the same IKE SA is shared ++ * between initiator and responder, ignore it for now and let ++ * the initiator retransmit. ++ */ ++ if (verbose_state_busy(&ike->sa)) { ++ return STF_IGNORE; ++ } ++ + struct child_sa *predecessor = NULL; + if (!find_v2N_REKEY_SA_child(ike, md, &predecessor)) { + record_v2N_response(ike->sa.st_logger, ike, md, v2N_INVALID_SYNTAX, +@@ -870,6 +879,15 @@ stf_status process_v2_CREATE_CHILD_SA_new_child_request(struct ike_sa *ike, + struct child_sa *larval_child, + struct msg_digest *md) + { ++ /* ++ * CRYPTO continuation is ongoing as the same IKE SA is shared ++ * between initiator and responder, ignore it for now and let ++ * the initiator retransmit. ++ */ ++ if (verbose_state_busy(&ike->sa)) { ++ return STF_IGNORE; ++ } ++ + pexpect(larval_child == NULL); + larval_child = new_v2_child_state(ike->sa.st_connection, + ike, IPSEC_SA, SA_RESPONDER, +-- +2.47.0 + diff --git a/libreswan.spec b/libreswan.spec index 6e96318..ddb349d 100644 --- a/libreswan.spec +++ b/libreswan.spec @@ -44,6 +44,7 @@ Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch Patch: libreswan-4.15-ondemand-tcp.patch Patch: libreswan-4.15-netlink-extack.patch Patch: libreswan-4.15-whack-fd-refcount.patch +Patch: libreswan-4.15-create-child-sa-race-condition.patch BuildRequires: audit-libs-devel BuildRequires: bison @@ -201,6 +202,7 @@ certutil -N -d sql:$tmpdir --empty-password %changelog * Tue Nov 12 2024 Daiki Ueno - 4.15-4 - pluto: fix refcounting of whack FD at CREATE_CHILD_SA request (RHEL-61461) +- pluto: ignore CREATE_CHILD_SA request if crypto is in progress (RHEL-61461) * Tue Aug 6 2024 Daiki Ueno - 4.15-3 - Fix release number