ikev1: Send and verify IPv6 addresses correctly

According to the mode-config draft there is no prefix sent for
IPv6 addresses in IKEv1.  We still accept 17 bytes long addresses for
backwards compatibility with older strongSwan releases.

Fixes #1304.
This commit is contained in:
Tobias Brunner
2016-03-03 17:32:03 +01:00
parent 2f3c08d268
commit 91d80298f9
2 changed files with 18 additions and 26 deletions
@@ -144,6 +144,13 @@ METHOD(payload_t, verify, status_t,
}
break;
case INTERNAL_IP6_ADDRESS:
if (this->type == PLV1_CONFIGURATION_ATTRIBUTE &&
this->length_or_value == 16)
{ /* 16 bytes are correct for IKEv1, but older releases sent a
* prefix byte so we still accept 0 or 17 as in IKEv2 */
break;
}
/* fall-through */
case INTERNAL_IP6_SUBNET:
if (this->length_or_value != 0 && this->length_or_value != 17)
{