unknown-payload: Use a new private payload type and make original type available

This fixes a DoS and potential remote code execution vulnerability that was
caused because the original payload type that was returned previously was
used to cast such payload objects to payloads of the indicated type (e.g.
when logging notify payloads with a payload type for the wrong IKE version).

Fixes CVE-2015-3991.
This commit is contained in:
Tobias Brunner
2015-06-01 09:42:11 +02:00
committed by Andreas Steffen
parent 62e0abe759
commit 1507647434
6 changed files with 35 additions and 10 deletions
@@ -1,4 +1,5 @@
/*
* Copyright (C) 2015 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
@@ -120,6 +121,12 @@ METHOD(payload_t, get_header_length, int,
METHOD(payload_t, get_payload_type, payload_type_t,
private_unknown_payload_t *this)
{
return PL_UNKNOWN;
}
METHOD(unknown_payload_t, get_type, payload_type_t,
private_unknown_payload_t *this)
{
return this->type;
}
@@ -181,6 +188,7 @@ unknown_payload_t *unknown_payload_create(payload_type_t type)
.destroy = _destroy,
},
.is_critical = _is_critical,
.get_type = _get_type,
.get_data = _get_data,
.destroy = _destroy,
},