denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allow to transmit 64k TLS Handshake and Application messages via EAP-[T]TLS

Browse Source
This commit is contained in:
Andreas Steffen
2012-07-11 17:09:04 +02:00
parent dfe82160e4
commit c36680962c
3 changed files with 23 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_fragmentation.c
+11 -16
View File
@@ -18,6 +18,11 @@
#include <bio/bio_reader.h>
#include <debug.h>
/**
* Maximum size of a TLS handshake message we accept
*/
#define TLS_MAX_HANDSHAKE_LEN 65536
typedef struct private_tls_fragmentation_t private_tls_fragmentation_t;
/**
@@ -93,16 +98,6 @@ struct private_tls_fragmentation_t {
tls_application_t *application;
};
/**
* Maximum size of a TLS fragment
*/
#define MAX_TLS_FRAGMENT_LEN 16384
/**
* Maximum size of a TLS handshake message we accept
*/
#define MAX_TLS_HANDSHAKE_LEN 65536
/**
* Process a TLS alert
*/
@@ -134,7 +129,7 @@ static status_t process_handshake(private_tls_fragmentation_t *this,
status_t status;
chunk_t data;
if (reader->remaining(reader) > MAX_TLS_FRAGMENT_LEN)
if (reader->remaining(reader) > TLS_MAX_FRAGMENT_LEN)
{
DBG1(DBG_TLS, "TLS fragment has invalid length");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
@@ -151,7 +146,7 @@ static status_t process_handshake(private_tls_fragmentation_t *this,
return NEED_MORE;
}
this->type = type;
if (len > MAX_TLS_HANDSHAKE_LEN)
if (len > TLS_MAX_HANDSHAKE_LEN)
{
DBG1(DBG_TLS, "TLS handshake exceeds maximum length");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
@@ -207,7 +202,7 @@ static status_t process_application(private_tls_fragmentation_t *this,
status_t status;
chunk_t data;
if (reader->remaining(reader) > MAX_TLS_FRAGMENT_LEN)
if (reader->remaining(reader) > TLS_MAX_FRAGMENT_LEN)
{
DBG1(DBG_TLS, "TLS fragment has invalid length");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
@@ -427,14 +422,14 @@ METHOD(tls_fragmentation_t, build, status_t,
if (this->output.len)
{
*type = this->output_type;
if (this->output.len <= MAX_TLS_FRAGMENT_LEN)
if (this->output.len <= TLS_MAX_FRAGMENT_LEN)
{
*data = this->output;
this->output = chunk_empty;
return NEED_MORE;
}
*data = chunk_create(this->output.ptr, MAX_TLS_FRAGMENT_LEN);
this->output = chunk_clone(chunk_skip(this->output, MAX_TLS_FRAGMENT_LEN));
*data = chunk_create(this->output.ptr, TLS_MAX_FRAGMENT_LEN);
this->output = chunk_clone(chunk_skip(this->output, TLS_MAX_FRAGMENT_LEN));
return NEED_MORE;
}
return status;