ike: Make check for known payloads depend on IKE version

This commit is contained in:
Tobias Brunner
2014-12-05 15:41:46 +01:00
parent 7bd5548538
commit fac310a467
4 changed files with 41 additions and 26 deletions
+1 -1
View File
@@ -2475,7 +2475,7 @@ static status_t decrypt_payloads(private_message_t *this, keymat_t *keymat)
was_encrypted = "encrypted fragment payload"; was_encrypted = "encrypted fragment payload";
} }
if (payload_is_known(type) && !was_encrypted && if (payload_is_known(type, this->major_version) && !was_encrypted &&
!is_connectivity_check(this, payload) && !is_connectivity_check(this, payload) &&
this->exchange_type != AGGRESSIVE) this->exchange_type != AGGRESSIVE)
{ {
+18 -4
View File
@@ -266,12 +266,16 @@ payload_t *payload_create(payload_type_t type)
/** /**
* See header. * See header.
*/ */
bool payload_is_known(payload_type_t type) bool payload_is_known(payload_type_t type, u_int8_t maj_ver)
{ {
if (type == PL_HEADER) if (type == PL_HEADER)
{ {
return TRUE; return TRUE;
} }
switch (maj_ver)
{
case 0:
case IKEV1_MAJOR_VERSION:
if (type >= PLV1_SECURITY_ASSOCIATION && type <= PLV1_CONFIGURATION) if (type >= PLV1_SECURITY_ASSOCIATION && type <= PLV1_CONFIGURATION)
{ {
return TRUE; return TRUE;
@@ -280,6 +284,16 @@ bool payload_is_known(payload_type_t type)
{ {
return TRUE; return TRUE;
} }
if (type >= PLV1_NAT_D_DRAFT_00_03 && type <= PLV1_FRAGMENT)
{
return TRUE;
}
if (maj_ver)
{
break;
}
/* fall-through */
case IKEV2_MAJOR_VERSION:
if (type >= PLV2_SECURITY_ASSOCIATION && type <= PLV2_EAP) if (type >= PLV2_SECURITY_ASSOCIATION && type <= PLV2_EAP)
{ {
return TRUE; return TRUE;
@@ -294,9 +308,9 @@ bool payload_is_known(payload_type_t type)
return TRUE; return TRUE;
} }
#endif #endif
if (type >= PLV1_NAT_D_DRAFT_00_03 && type <= PLV1_FRAGMENT) break;
{ default:
return TRUE; break;
} }
return FALSE; return FALSE;
} }
+2 -1
View File
@@ -405,9 +405,10 @@ payload_t *payload_create(payload_type_t type);
* Check if a specific payload is implemented, or handled as unknown payload. * Check if a specific payload is implemented, or handled as unknown payload.
* *
* @param type type of the payload to check * @param type type of the payload to check
* @param maj_ver major IKE version (use 0 to skip version check)
* @return FALSE if payload type handled as unknown payload * @return FALSE if payload type handled as unknown payload
*/ */
bool payload_is_known(payload_type_t type); bool payload_is_known(payload_type_t type, u_int8_t maj_ver);
/** /**
* Get the value field in a payload using encoding rules. * Get the value field in a payload using encoding rules.
+1 -1
View File
@@ -1170,7 +1170,7 @@ static status_t parse_message(private_task_manager_t *this, message_t *msg)
{ {
unknown = (unknown_payload_t*)payload; unknown = (unknown_payload_t*)payload;
type = payload->get_type(payload); type = payload->get_type(payload);
if (!payload_is_known(type) && if (!payload_is_known(type, msg->get_major_version(msg)) &&
unknown->is_critical(unknown)) unknown->is_critical(unknown))
{ {
DBG1(DBG_ENC, "payload type %N is not supported, " DBG1(DBG_ENC, "payload type %N is not supported, "