denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-init: Fail if DH group in KE payload does not match proposed group

Browse Source
This commit is contained in:
Tobias Brunner
2017-09-04 11:02:55 +02:00
parent 9c03e8c80b
commit bd371590ab
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_init.c
+5 -1
View File
@@ -502,7 +502,11 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
this->dh = this->keymat->keymat.create_dh( this->dh = this->keymat->keymat.create_dh(
&this->keymat->keymat, this->dh_group); &this->keymat->keymat, this->dh_group);
} }
if (this->dh) else if (this->dh)
{
this->dh_failed = this->dh->get_dh_group(this->dh) != this->dh_group;
}
if (this->dh && !this->dh_failed)
{ {
this->dh_failed = !this->dh->set_other_public_value(this->dh, this->dh_failed = !this->dh->set_other_public_value(this->dh,
ke_payload->get_key_exchange_data(ke_payload)); ke_payload->get_key_exchange_data(ke_payload));