Attachment 923400 Details for Bug 1126066 – dcookie-bad-pointer patch

[patch] dcookie-bad-pointer patch

openswan-libreswan-backport-1126066.patch (text/plain), 1.91 KB, created by Paul Wouters on 2014-08-01 18:44:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Paul Wouters

Created: 2014-08-01 18:44:44 UTC

Size: 1.91 KB

patch

obsolete

>diff -Naur openswan-2.6.32-orig/programs/pluto/ikev2_parent.c openswan-2.6.32/programs/pluto/ikev2_parent.c
>--- openswan-2.6.32-orig/programs/pluto/ikev2_parent.c	2014-08-01 14:12:10.031000000 -0400
>+++ openswan-2.6.32/programs/pluto/ikev2_parent.c	2014-08-01 14:40:54.972000000 -0400
>@@ -76,7 +76,7 @@
> 						, struct pluto_crypto_req *r);
> 
> static bool ikev2_get_dcookie(u_char *dcookie, chunk_t st_ni
>-	,ip_address *addr, u_int8_t *spiI); 
>+	,ip_address *addr, chunk_t spiI); 
> 
> static stf_status ikev2_parent_outI1_common(struct msg_digest *md
> 					    , struct state *st);
>@@ -557,9 +557,14 @@
> 	 */ 
> 	if(force_busy == TRUE) 
> 	{ 
>-	    u_char dcookie[SHA1_DIGEST_SIZE];
>-		chunk_t dc;
>-		ikev2_get_dcookie( dcookie, st->st_ni, &md->sender, st->st_icookie);
>+		u_char dcookie[SHA1_DIGEST_SIZE];
>+		chunk_t dc, ni, spiI;
>+
>+		setchunk(spiI, md->hdr.isa_icookie, COOKIE_SIZE);
>+		setchunk(ni, md->chain[ISAKMP_NEXT_v2Ni]->pbs.cur,
>+			md->chain[ISAKMP_NEXT_v2Ni]->payload.v2gen.isag_length);
>+
>+		ikev2_get_dcookie(dcookie, ni, &md->sender, spiI);
> 		dc.ptr = dcookie;
> 		dc.len = SHA1_DIGEST_SIZE;
> 
>@@ -2206,8 +2211,8 @@
>  * where <secret> is a randomly generated secret known only to the
>  * in OSW implementation <VersionIDofSecret> is not used.
>  */
>-static bool ikev2_get_dcookie(u_char *dcookie,  chunk_t st_ni
>-	,ip_address *addr, u_int8_t *spiI)
>+static bool ikev2_get_dcookie(u_char *dcookie,  chunk_t ni
>+	,ip_address *addr, chunk_t spiI)
> {
>     	size_t addr_length;
> 	SHA1_CTX	ctx_sha1;
>@@ -2217,9 +2222,9 @@
> 
> 	addr_length = addrbytesof(addr, addr_buff, sizeof(addr_buff));
> 	SHA1Init(&ctx_sha1);
>-	SHA1Update(&ctx_sha1, st_ni.ptr, st_ni.len);
>+	SHA1Update(&ctx_sha1, ni.ptr, ni.len);
> 	SHA1Update(&ctx_sha1, addr_buff, addr_length);
>-	SHA1Update(&ctx_sha1, spiI, sizeof(spiI));
>+	SHA1Update(&ctx_sha1, spiI.ptr, spiI.len);
> 	SHA1Update(&ctx_sha1, ikev2_secret_of_the_day
> 		 , SHA1_DIGEST_SIZE);
> 	SHA1Final(dcookie, &ctx_sha1);

Actions: View | Diff

Attachments on bug 1126066: 923400