denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libtls: Check for CHANGE_CIPHER_SPEC type only if upper layer returns NEED_MORE

Browse Source 
A type is returned only if upper layers successfully created a record, that is
returns NEED_MORE. If we do not check for the return value, we might check a
previous record or the uninitialized type variable and falsely reset the
sequence number.
This commit is contained in:
Martin Willi
2015-01-12 14:18:24 +01:00
parent aa71c19e5c
commit 780bf2b8e9
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_protection.c
+5 -6
View File
@@ -101,14 +101,13 @@ METHOD(tls_protection_t, build, status_t,
status_t status; status_t status;
status = this->compression->build(this->compression, type, data); status = this->compression->build(this->compression, type, data);
if (*type == TLS_CHANGE_CIPHER_SPEC)
{
this->seq_out = 0;
return status;
}
if (status == NEED_MORE) if (status == NEED_MORE)
{ {
if (*type == TLS_CHANGE_CIPHER_SPEC)
{
this->seq_out = 0;
return status;
}
if (this->aead_out) if (this->aead_out)
{ {
if (!this->aead_out->encrypt(this->aead_out, this->version, if (!this->aead_out->encrypt(this->aead_out, this->version,