|
 |
04df865 |
commit 08f735e881d314f5b38b55cbc8a9d7abdb9b18f8
|
|
|
04df865 |
Author: Paul Wouters <pwouters@redhat.com>
|
|
|
04df865 |
Date: Sun Jul 14 13:27:39 2013 -0400
|
|
|
04df865 |
|
|
|
04df865 |
pluto: work around for Cisco VPN clients sending extraneous bytes
|
|
|
04df865 |
|
|
|
04df865 |
diff --git a/programs/pluto/demux.c b/programs/pluto/demux.c
|
|
|
04df865 |
index cc4be99..1ae2f40 100644
|
|
|
04df865 |
--- a/programs/pluto/demux.c
|
|
|
04df865 |
+++ b/programs/pluto/demux.c
|
|
|
04df865 |
@@ -146,12 +146,29 @@ void process_packet(struct msg_digest **mdp)
|
|
|
04df865 |
}
|
|
|
04df865 |
}
|
|
|
04df865 |
|
|
|
04df865 |
- if (md->packet_pbs.roof != md->message_pbs.roof) {
|
|
|
04df865 |
+ if (md->packet_pbs.roof < md->message_pbs.roof) {
|
|
|
04df865 |
libreswan_log(
|
|
|
04df865 |
- "size (%u) differs from size specified in ISAKMP HDR (%u)",
|
|
|
04df865 |
- (unsigned) pbs_room(
|
|
|
04df865 |
- &md->packet_pbs), md->hdr.isa_length);
|
|
|
04df865 |
+ "received packet size (%u) is smaller than from "
|
|
|
04df865 |
+ "size specified in ISAKMP HDR (%u) - packet dropped",
|
|
|
04df865 |
+ (unsigned) pbs_room(&md->packet_pbs),
|
|
|
04df865 |
+ md->hdr.isa_length);
|
|
|
04df865 |
+ /* abort processing corrupt packet */
|
|
|
04df865 |
return;
|
|
|
04df865 |
+ } else if (md->packet_pbs.roof > md->message_pbs.roof) {
|
|
|
04df865 |
+ /*
|
|
|
04df865 |
+ * Some (old?) versions of the Cisco VPN client send an additional
|
|
|
04df865 |
+ * 16 bytes of zero bytes - Complain but accept it
|
|
|
04df865 |
+ */
|
|
|
04df865 |
+ DBG(DBG_CONTROL, {
|
|
|
04df865 |
+ DBG_log(
|
|
|
04df865 |
+ "size (%u) in received packet is larger than the size "
|
|
|
04df865 |
+ "specified in ISAKMP HDR (%u) - ignoring extraneous bytes",
|
|
|
04df865 |
+ (unsigned) pbs_room(&md->packet_pbs),
|
|
|
04df865 |
+ md->hdr.isa_length);
|
|
|
04df865 |
+ DBG_dump("extraneous bytes:", md->message_pbs.roof,
|
|
|
04df865 |
+ md->packet_pbs.roof - md->message_pbs.roof);
|
|
|
04df865 |
+ /* continue */
|
|
|
04df865 |
+ });
|
|
|
04df865 |
}
|
|
|
04df865 |
|
|
|
04df865 |
maj = (md->hdr.isa_version >> ISA_MAJ_SHIFT);
|