ikev1: Send and verify IPv6 addresses correctly
According to the mode-config draft there is no prefix sent for IPv6 addresses in IKEv1. We still accept 17 bytes long addresses for backwards compatibility with older strongSwan releases. Fixes #1304.
This commit is contained in:
@@ -144,6 +144,13 @@ METHOD(payload_t, verify, status_t,
|
||||
}
|
||||
break;
|
||||
case INTERNAL_IP6_ADDRESS:
|
||||
if (this->type == PLV1_CONFIGURATION_ATTRIBUTE &&
|
||||
this->length_or_value == 16)
|
||||
{ /* 16 bytes are correct for IKEv1, but older releases sent a
|
||||
* prefix byte so we still accept 0 or 17 as in IKEv2 */
|
||||
break;
|
||||
}
|
||||
/* fall-through */
|
||||
case INTERNAL_IP6_SUBNET:
|
||||
if (this->length_or_value != 0 && this->length_or_value != 17)
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user