[Openswan dev] 2.4.4 doesn't fix pluto crashing on unexpected (aggressive moderequest ?!) packet

Albert Siersema appie at friendly.net
Fri Nov 18 15:28:09 CET 2005


-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

I've compiled OpenS/WAN with these changes in Makefile.inc:
USE_AGGRESSIVE?=false
USE_XAUTH?=false

pluto crashes on receiving an unexpected packet from a peer running Sonicwall pro 3060 with sonicos enhanced
(latest OS version as far as the person I talked to could say).
There's an up & running tunnel to this device but it sends us a packet over a backup WAN line as well
(also connected to the same sonicwall). I'm not sure why it does this, I've reported it to the sonicwall
admin guy to look into. Nevertheless, the packet does crash pluto.

The debug log shows:

Nov 14 15:00:10 myhost pluto[778]: | *received 1400 bytes from a.b.c.d:500 on eth1 (port=500)
<1024 bytes hex dump snipped>
Nov 14 15:00:10 myhost pluto[778]: | **parse ISAKMP Message:
Nov 14 15:00:10 myhost pluto[778]: |    initiator cookie:
Nov 14 15:00:10 myhost pluto[778]: |   ....
Nov 14 15:00:10 myhost pluto[778]: |    responder cookie:
Nov 14 15:00:10 myhost pluto[778]: |   00 00 00 00  00 00 00 00
Nov 14 15:00:10 myhost pluto[778]: |    next payload type: ISAKMP_NEXT_SA
Nov 14 15:00:10 myhost pluto[778]: |    ISAKMP version: ISAKMP Version 1.0
Nov 14 15:00:10 myhost pluto[778]: |    exchange type: ISAKMP_XCHG_AGGR
Nov 14 15:00:10 myhost pluto[778]: |    flags: none
Nov 14 15:00:10 myhost pluto[778]: |    message ID:  00 00 00 00
Nov 14 15:00:10 myhost pluto[778]: |    length: 1400
Nov 14 15:00:10 myhost pluto[778]: |  processing packet with exchange type=ISAKMP_XCHG_AGGR (4)

pluto core dumps on:

#0  0x080782e4 in process_packet (mdp=0x80e04ec) at demux.c:2059
2059            if (smc->flags & SMF_INPUT_ENCRYPTED)

And yes:
(gdb) print smc
$1 = (const struct state_microcode *) 0x0

More info:

(gdb) l
2054        }
2055        else
2056        {
2057            /* packet was not encryped -- should it have been? */
2058
2059            if (smc->flags & SMF_INPUT_ENCRYPTED)
2060            {
2061                loglog(RC_LOG_SERIOUS, "packet rejected: should have been encrypted");
2062                SEND_NOTIFICATION(INVALID_FLAGS);
2063                return;

(gdb) bt
#0  0x080782e4 in process_packet (mdp=0x80e04ec) at demux.c:2059
#1  0x08079650 in comm_handle (ifp=0x80f4948) at demux.c:1223
#2  0x0805e92e in call_server () at server.c:1161
#3  0x0805b58b in main (argc=3, argv=0xbfffef44) at plutomain.c:783
#4  0x40062dc6 in iconv_open () from /lib/libc.so.6

(gdb) bt full
#0  0x080782e4 in process_packet (mdp=0x80e04ec) at demux.c:2059
        md = (struct msg_digest *) 0x80f5090
        smc = (const struct state_microcode *) 0x0
        new_iv_set = 0
        st = (struct state *) 0x0
        from_state = STATE_UNDEFINED
#1  0x08079650 in comm_handle (ifp=0x80f4948) at demux.c:1223
        md = (struct msg_digest *) 0x80f5090
#2  0x0805e92e in call_server () at server.c:1161
        ifp = (struct iface_port *) 0x0
#3  0x0805b58b in main (argc=3, argv=0xbfffef44) at plutomain.c:783
        fork_desired = 0
        log_to_stderr_desired = 0
        ocspuri = 0x0
        nhelpers = -1
        coredir = 0x0
        nat_traversal = 0
        nat_t_spf = 1
        keep_alive = 0
        force_keepalive = 0
        virtual_private = 0x0
#4  0x40062dc6 in iconv_open () from /lib/libc.so.6
No symbol table info available.

(gdb) print md->hdr.isa_xchg
$2 = 4 '\004'
ennuh:
#define ISAKMP_XCHG_AGGR       4     /* Aggressive */

(gdb) print *md
$1 = {next = 0x0, raw_packet = {ptr = 0x0, len = 0}, iface = 0x80f4948, sender = {u = {v4 = {sin_family = 2, sin_port = 62465, sin_addr = {
          s_addr = 2531214673}, sin_zero = "\000\000\000\000\000\000\000"}, v6 = {sin6_family = 2, sin6_port = 62465,
        sin6_flowinfo = 2531214673, sin6_addr = {in6_u = {u6_addr8 = '\0' <repeats 15 times>, u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, u6_addr32 = {
              0, 0, 0, 0}}}, sin6_scope_id = 0}}}, sender_port = 500, packet_pbs = {container = 0x0, desc = 0x0, name = 0x80c08cc "packet",
    start = 0x80f8428 "?\226?G0?\025?", cur = 0x80f89a0 "woz\210?", roof = 0x80f89a0 "woz\210?", lenfld = 0x0, lenfld_desc = 0x0},
  message_pbs = {container = 0x80f50c0, desc = 0x80db4fc, name = 0x80db94e "ISAKMP Message", start = 0x80f8428 "?\226?G0?\025?",
    cur = 0x80f8444 "\004", roof = 0x80f89a0 "woz\210?", lenfld = 0x0, lenfld_desc = 0x0}, hdr = {isa_icookie = "?\226?G0?\025?",
    isa_rcookie = "\000\000\000\000\000\000\000", isa_np = 1 '\001', isa_version = 16 '\020', isa_xchg = 4 '\004', isa_flags = 0 '\0',
    isa_msgid = 0, isa_length = 1400}, encrypted = 0, from_state = STATE_UNDEFINED, smc = 0x0, st = 0x0, reply = {container = 0x0, desc = 0x0,
    name = 0x80bc499 "reply packet", start = 0x80e2540 "?L{?\234 :C??l\217\022+??\b\020\005\001p\231?X",
    cur = 0x80e2540 "?L{?\234 :C??l\217\022+??\b\020\005\001p\231?X", roof = 0x80f2540 "", lenfld = 0x0, lenfld_desc = 0x0}, rbody = {
    container = 0x0, desc = 0x0, name = 0x0, start = 0x0, cur = 0x0, roof = 0x0, lenfld = 0x0, lenfld_desc = 0x0}, note = NOTHING_WRONG,
  dpd = 0, digest = {{pbs = {container = 0x0, desc = 0x0, name = 0x0, start = 0x0, cur = 0x0, roof = 0x0, lenfld = 0x0, lenfld_desc = 0x0},
      payload = {generic = {isag_np = 0 '\0', isag_reserved = 0 '\0', isag_length = 0}, sa = {isasa_np = 0 '\0', isasa_reserved = 0 '\0',
          isasa_length = 0, isasa_doi = 0}, proposal = {isap_np = 0 '\0', isap_reserved = 0 '\0', isap_length = 0, isap_proposal = 0 '\0',
          isap_protoid = 0 '\0', isap_spisize = 0 '\0', isap_notrans = 0 '\0'}, transform = {isat_np = 0 '\0', isat_reserved = 0 '\0',
          isat_length = 0, isat_transnum = 0 '\0', isat_transid = 0 '\0', isat_reserved2 = 0}, id = {isaid_np = 0 '\0', isaid_reserved = 0 '\0',
          isaid_length = 0, isaid_idtype = 0 '\0', isaid_doi_specific_a = 0 '\0', isaid_doi_specific_b = 0}, cert = {isacert_np = 0 '\0',
          isacert_reserved = 0 '\0', isacert_length = 0, isacert_type = 0 '\0'}, cr = {isacr_np = 0 '\0', isacr_reserved = 0 '\0',
          isacr_length = 0, isacr_type = 0 '\0'}, ipsec_id = {isaiid_np = 0 '\0', isaiid_reserved = 0 '\0', isaiid_length = 0,
          isaiid_idtype = 0 '\0', isaiid_protoid = 0 '\0', isaiid_port = 0}, notification = {isan_np = 0 '\0', isan_reserved = 0 '\0',
          isan_length = 0, isan_doi = 0, isan_protoid = 0 '\0', isan_spisize = 0 '\0', isan_type = 0}, delete = {isad_np = 0 '\0',
          isad_reserved = 0 '\0', isad_length = 0, isad_doi = 0, isad_protoid = 0 '\0', isad_spisize = 0 '\0', isad_nospi = 0}, nat_oa = {
          isanoa_np = 0 '\0', isanoa_reserved_1 = 0 '\0', isanoa_length = 0, isanoa_idtype = 0 '\0', isanoa_reserved_2 = 0 '\0',
          isanoa_reserved_3 = 0}, attribute = {isama_np = 0 '\0', isama_reserved = 0 '\0', isama_length = 0, isama_type = 0 '\0',
          isama_reserved2 = 0 '\0', isama_identifier = 0}}, next = 0x0} <repeats 20 times>}, digest_roof = 0x80f5174, chain = {
    0x0 <repeats 22 times>}, quirks = {xauth_ack_msgid = 0, modecfg_pull_mode = 0, nat_traversal_vid = 0}}


As far as I can quickly glance from the code smc is initialized from ike_microcode_index[].
Apparently it's a pointer to a struct.
Variable from_state == STATE_UNDEFINED (== STATE_IKE_FLOOR it appears ?!).
(as < STATE_IKE_FLOOR would be caught by a passert).
There's no check in the code if smc is a valid pointer, or != NULL either.
But it is used in several places:

    const struct state_microcode *smc;
    /* Set smc to describe this state's properties.
    smc = ike_microcode_index[from_state - STATE_IKE_FLOOR];
      while (!LHAS(smc->flags, baseauth))
          smc++;
          passert(smc->state == from_state);
        if (smc->flags & SMF_RETRANSMIT_ON_DUPLICATE)
        if (smc->flags & SMF_INPUT_ENCRYPTED)
        lset_t needed = smc->req_payloads;
            = LIN(SMF_PSK_AUTH | SMF_FIRST_ENCRYPTED_INPUT, smc->flags)
                , needed | smc->opt_payloads| LELEM(ISAKMP_NEXT_N) | LELEM(ISAKMP_NEXT_D)))
    md->smc = smc;
    if (smc->first_out_payload != ISAKMP_NEXT_NONE)
        echo_hdr(md, (smc->flags & SMF_OUTPUT_ENCRYPTED) != 0
            , smc->first_out_payload);
    complete_state_transition(mdp, smc->processor(md));



I noticed there's no such thing in demux.c / process_packet() [ line 1475 in 2.4.4 ] like:

#if defined(AGGRESSIVE)
    case ISAKMP_XCHG_AGGR:
#endif

(but who knows, that might not be necessary ?!)


There don't appear to be any fixes in 2.4.4 for this issue nor did I see a reference to it in openswan mantis.
Therefore I thought it might be a good idea to post it to the proper channel (i.e. the dev list ?)
with as much info as possible. If you need more info, let me know by direct email (off-dev-list).

TIA,
Albert
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDfeT5KltZixSsH2QRA9BvAJ0bXEr+4o18dtx9hgkJmQggfe9AwwCeMPYH
q1xadXl5bxRFsml6auX7wmw=
=3zHv
-----END PGP SIGNATURE-----


More information about the Dev mailing list