forked from pool/strongswan
Jan Engelhardt
cf0313df27
the hmac files, it provides the configuration drop in to
enforce fips mode.
- Removes deprecated SysV support
- Added prf-plus-modularization.patch that outsources the IKE
- move file %{_datadir}/dbus-1/system.d/nm-strongswan-service.conf
to strongswan-nm subpackage, as it is needed for the
NetworkManager plugin that uses strongswan-nm, not
- Removed unused requires and macro calls(bsc#1083261)
improved oracle are not compatible with the earlier
(wasn't the case since 5.0.0) and packets that have the flag
also checked against IKEv2 signature schemes. If such
constraints are used for certificate chain validation in
transport mode connections coming over the same NAT device for
Windows 7 IKEv2 clients, which announces its services over the
* For the vici plugin a Python Egg has been added to allow
Python applications to control or monitor the IKE daemon using
* EAP server methods now can fulfill public key constraints,
- Fix build in factory
- Fix systemd unit dir
from glibc
IDr payload anymore.
* Consistent logging of IKE and CHILD SAs at the audit (AUD) level.
caused an INVALID_SYNTAX error on PowerPC platforms.
- Initial, unfinished package
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=165
28 lines
1.1 KiB
Diff
28 lines
1.1 KiB
Diff
From 4e16732c1c668c27e73574724d2d90537a74f67a Mon Sep 17 00:00:00 2001
|
|
From: Tobias Brunner <tobias@strongswan.org>
|
|
Date: Fri, 17 Jun 2016 18:19:48 +0200
|
|
Subject: [PATCH] ikev1: Don't retransmit Aggressive Mode response
|
|
|
|
These could theoretically be used for an amplified DDoS attack.
|
|
---
|
|
src/libcharon/sa/ikev1/task_manager_v1.c | 3 +--
|
|
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
|
diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c
|
|
index 48ec3e7..0912555 100644
|
|
--- a/src/libcharon/sa/ikev1/task_manager_v1.c
|
|
+++ b/src/libcharon/sa/ikev1/task_manager_v1.c
|
|
@@ -770,8 +770,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
|
|
continue;
|
|
case NEED_MORE:
|
|
/* processed, but task needs another exchange */
|
|
- if (task->get_type(task) == TASK_QUICK_MODE ||
|
|
- task->get_type(task) == TASK_AGGRESSIVE_MODE)
|
|
+ if (task->get_type(task) == TASK_QUICK_MODE)
|
|
{ /* we rely on initiator retransmission, except for
|
|
* three-message exchanges */
|
|
expect_request = TRUE;
|
|
--
|
|
2.13.2
|
|
|