diff options
| author | Martin Willi <martin@revosec.ch> | 2011-11-18 17:14:36 +0100 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2012-03-20 17:30:44 +0100 |
| commit | 31fc14e394203be67a711801819a73a7365f9800 (patch) | |
| tree | 5aaf645552f028d792630816fb99e1779188ae98 /src/libcharon/encoding | |
| parent | 6c2b7d4ed9befd4f9e573a2c75c32eaefe8eca19 (diff) | |
| download | strongswan-31fc14e394203be67a711801819a73a7365f9800.tar.bz2 strongswan-31fc14e394203be67a711801819a73a7365f9800.tar.xz | |
Verify IKEv1 nonce size, send 32 byte nonces
Diffstat (limited to 'src/libcharon/encoding')
| -rw-r--r-- | src/libcharon/encoding/payloads/nonce_payload.c | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/src/libcharon/encoding/payloads/nonce_payload.c b/src/libcharon/encoding/payloads/nonce_payload.c index 58ef70a0e..3c5eeb535 100644 --- a/src/libcharon/encoding/payloads/nonce_payload.c +++ b/src/libcharon/encoding/payloads/nonce_payload.c @@ -19,6 +19,7 @@ #include "nonce_payload.h" +#include <daemon.h> #include <encoding/payloads/encodings.h> typedef struct private_nonce_payload_t private_nonce_payload_t; @@ -103,8 +104,26 @@ static encoding_rule_t encodings[] = { METHOD(payload_t, verify, status_t, private_nonce_payload_t *this) { - if (this->nonce.len < 16 || this->nonce.len > 256) + bool bad_length = FALSE; + + if (this->nonce.len > 256) + { + bad_length = TRUE; + } + if (this->type == NONCE && + this->nonce.len < 16) + { + bad_length = TRUE; + } + if (this->type == NONCE_V1 && + this->nonce.len < 8) + { + bad_length = TRUE; + } + if (bad_length) { + DBG1(DBG_ENC, "%N payload has invalid length (%d bytes)", + payload_type_names, this->type, this->nonce.len); return FAILED; } return SUCCESS; |