denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

eap-ttls: Limit maximum length of tunneled EAP packet to EAP-TTLS packet

Browse Source
This commit is contained in:
Tobias Brunner
2015-08-27 15:29:16 +02:00
parent 03024f4ca8
commit fbb593092e
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+8 -1
View File
@@ -112,6 +112,13 @@ METHOD(tls_application_t, process, status_t,
eap_data = avp_data; eap_data = avp_data;
break; break;
} }
else if (eap_len > reader->remaining(reader) + avp_data.len)
{
/* rough size check, ignoring AVP headers in remaining data */
DBG1(DBG_IKE, "EAP packet too large for EAP-TTLS AVP(s)");
chunk_free(&avp_data);
return FAILED;
}
else if (avp_data.len == MAX_RADIUS_ATTRIBUTE_SIZE) else if (avp_data.len == MAX_RADIUS_ATTRIBUTE_SIZE)
{ {
/* non-standard: EAP packet segmented into multiple AVPs */ /* non-standard: EAP packet segmented into multiple AVPs */
@@ -128,7 +135,7 @@ METHOD(tls_application_t, process, status_t,
if (avp_data.len > eap_data.len - eap_pos) if (avp_data.len > eap_data.len - eap_pos)
{ {
DBG1(DBG_IKE, "AVP size to large to fit into EAP packet"); DBG1(DBG_IKE, "AVP size too large to fit into EAP packet");
chunk_free(&avp_data); chunk_free(&avp_data);
chunk_free(&eap_data); chunk_free(&eap_data);
return FAILED; return FAILED;