denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent endless loop with oversize attributes

Browse Source
This commit is contained in:
Andreas Steffen
2012-07-12 21:26:18 +02:00
parent 968c83cdeb
commit 8ef43d8786
2 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/imc/imc_agent.c
+16 -3
View File
@@ -384,7 +384,7 @@ METHOD(imc_agent_t, create_state, TNC_Result,
"%slong %sexcl %ssoh", this->id, this->name,
tnccs_p ? tnccs_p:"?", tnccs_v ? tnccs_v:"?", conn_id,
has_long ? "+":"-", has_excl ? "+":"-", has_soh ? "+":"-");
DBG2(DBG_IMC, " over %s %s with maximum PA-TNC msg size of %u bytes",
DBG2(DBG_IMC, " over %s %s with maximum PA-TNC message size of %u bytes",
t_p ? t_p:"?", t_v ? t_v :"?", max_msg_len);
free(tnccs_p);
@@ -485,6 +485,7 @@ METHOD(imc_agent_t, send_message, TNC_Result,
pa_tnc_msg_t *pa_tnc_msg;
chunk_t msg;
enumerator_t *enumerator;
bool attr_added;
state = find_connection(this, connection_id);
if (!state)
@@ -497,13 +498,25 @@ METHOD(imc_agent_t, send_message, TNC_Result,
while (attr_list->get_count(attr_list))
{
pa_tnc_msg = pa_tnc_msg_create(state->get_max_msg_len(state));
attr_added = FALSE;
enumerator = attr_list->create_enumerator(attr_list);
while (enumerator->enumerate(enumerator, &attr))
{
if (!pa_tnc_msg->add_attribute(pa_tnc_msg, attr))
if (pa_tnc_msg->add_attribute(pa_tnc_msg, attr))
{
break;
attr_added = TRUE;
}
else
{
if (attr_added)
{
break;
}
else
{
DBG1(DBG_IMC, "PA-TNC attribute too large to send, deleted");
}
}
attr_list->remove_at(attr_list, enumerator);
}
src/libimcv/imv/imv_agent.c
+16 -5
View File
@@ -407,7 +407,7 @@ METHOD(imv_agent_t, create_state, TNC_Result,
"%slong %sexcl %ssoh", this->id, this->name,
tnccs_p ? tnccs_p:"?", tnccs_v ? tnccs_v:"?", conn_id,
has_long ? "+":"-", has_excl ? "+":"-", has_soh ? "+":"-");
DBG2(DBG_IMV, " over %s %s with maximum PA-TNC msg size of %u bytes",
DBG2(DBG_IMV, " over %s %s with maximum PA-TNC message size of %u bytes",
t_p ? t_p:"?", t_v ? t_v :"?", max_msg_len);
free(tnccs_p);
@@ -507,6 +507,7 @@ METHOD(imv_agent_t, send_message, TNC_Result,
pa_tnc_msg_t *pa_tnc_msg;
chunk_t msg;
enumerator_t *enumerator;
bool attr_added;
state = find_connection(this, connection_id);
if (!state)
@@ -516,17 +517,27 @@ METHOD(imv_agent_t, send_message, TNC_Result,
return TNC_RESULT_FATAL;
}
pa_tnc_msg = pa_tnc_msg_create(this->max_msg_len);
while (attr_list->get_count(attr_list))
{
pa_tnc_msg = pa_tnc_msg_create(this->max_msg_len);
attr_added = FALSE;
enumerator = attr_list->create_enumerator(attr_list);
while (enumerator->enumerate(enumerator, &attr))
{
if (!pa_tnc_msg->add_attribute(pa_tnc_msg, attr))
if (pa_tnc_msg->add_attribute(pa_tnc_msg, attr))
{
break;
attr_added = TRUE;
}
else
{
if (attr_added)
{
break;
}
else
{
DBG1(DBG_IMV, "PA-TNC attribute too large to send, deleted");
}
}
attr_list->remove_at(attr_list, enumerator);
}