On Thu, Oct 19, 2017 at 10:38:57AM -0400, Andrew Cagney wrote:
> where it sends out the AUTH reply (an st_event), and a short while later
> sends out an XAUTH request (an st_send_xauth_event, recent changes mean it
> is generated from scratch and doesn't replace the AUTH reply?).
>
> With this, the problem I'm seeing is that when the initiator comes back
> with its XAUTH reply, the responder, in xauth_launch_authent() needs to
> cancel both the RETRANSMIT and the SEND_XAUTH but it only cancels the first
> and only when PAM. This lets SEND_XAUTH fire repeatedly and even after PAM
> finishes and the final reply sent, and its code uses change_state() to
> blungeon the state back to XAUTH_R0 resulting in much confusion.
here is a fix that comes to my mind.
I am hopping this works for aggressive mode and main mode.
-antony
>From 2fe40fd8f9b9583f5712a8fd01905fd751490070 Mon Sep 17 00:00:00 2001
From: Antony Antony <ant...@phenome.org>
Date: Thu, 19 Oct 2017 19:33:38 +0000
Subject: [PATCH] xauth: cancel pending EVENT_v1_SEND_XAUTH
IKEv1 responder, when an xauth response arrive cancel
the pending EVENT_v1_SEND_XAUTH
---
programs/pluto/ikev1_xauth.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/programs/pluto/ikev1_xauth.c b/programs/pluto/ikev1_xauth.c
index 233572c1f..2316448b9 100644
--- a/programs/pluto/ikev1_xauth.c
+++ b/programs/pluto/ikev1_xauth.c
@@ -1177,6 +1177,8 @@ static int xauth_launch_authent(struct state *st,
ikev1_xauth_callback);
delete_event(st);
event_schedule(EVENT_PAM_TIMEOUT, EVENT_PAM_TIMEOUT_DELAY, st);
+
+ delete_state_event(st, &st->st_send_xauth_event);
break;
#endif
case XAUTHBY_FILE:
--
2.13.5
_______________________________________________
Swan-dev mailing list
Swan-dev@lists.libreswan.org
https://lists.libreswan.org/mailman/listinfo/swan-dev
