denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate payload to rebuild_auth, works with injected unknown payloads

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:45:55 +01:00
parent 5c95bf7b93
commit 9992cb1c10
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/conftest/hooks/rebuild_auth.c
+17 -13
View File
@@ -15,6 +15,7 @@
#include "hook.h" #include "hook.h"
#include <encoding/generator.h>
#include <encoding/payloads/nonce_payload.h> #include <encoding/payloads/nonce_payload.h>
#include <encoding/payloads/auth_payload.h> #include <encoding/payloads/auth_payload.h>
#include <encoding/payloads/id_payload.h> #include <encoding/payloads/id_payload.h>
@@ -58,28 +59,31 @@ static bool rebuild_auth(private_rebuild_auth_t *this, ike_sa_t *ike_sa,
signature_scheme_t scheme; signature_scheme_t scheme;
keymat_t *keymat; keymat_t *keymat;
identification_t *id; identification_t *id;
id_payload_t *id_payload;
char reserved[3]; char reserved[3];
u_int8_t *byte; generator_t *generator;
int i; chunk_t data;
u_int32_t *lenpos;
id_payload = (id_payload_t*)message->get_payload(message, payload = message->get_payload(message,
message->get_request(message) ? ID_INITIATOR : ID_RESPONDER); message->get_request(message) ? ID_INITIATOR : ID_RESPONDER);
if (!id_payload) if (!payload)
{ {
DBG1(DBG_CFG, "ID payload not found to rebuild AUTH"); DBG1(DBG_CFG, "ID payload not found to rebuild AUTH");
return FALSE; return FALSE;
} }
id = id_payload->get_identification(id_payload);
for (i = 0; i < countof(reserved); i++) generator = generator_create();
generator->generate_payload(generator, payload);
data = generator->get_chunk(generator, &lenpos);
if (data.len < 8)
{ {
byte = payload_get_field(&id_payload->payload_interface, DBG1(DBG_CFG, "ID payload invalid to rebuild AUTH");
RESERVED_BYTE, i); generator->destroy(generator);
if (byte) return FALSE;
{
reserved[i] = *byte;
}
} }
memcpy(reserved, data.ptr + 5, 3);
id = identification_create_from_encoding(data.ptr[4], chunk_skip(data, 8));
generator->destroy(generator);
auth = auth_cfg_create(); auth = auth_cfg_create();
private = lib->credmgr->get_private(lib->credmgr, KEY_ANY, id, auth); private = lib->credmgr->get_private(lib->credmgr, KEY_ANY, id, auth);