denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

encrypted-payload: Do basic decryption check only once

Browse Source 
The check only references the original chunk, so for each parsed payload
it checks the same thing.  The length of each individual payload is
checked by the parser anyway.  So I think this was primarily added for
the IKEv1 "wrong PSK" use case.  Let's keep it for now.

Fixes: dd5c3787dc ("Give a hint that decryption failed if payload length invalid")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:39 +02:00
parent 52b689c4f8
commit 11241a8379
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/encoding/payloads/encrypted_payload.c
+9 -9
View File
@@ -575,22 +575,22 @@ METHOD(encrypted_payload_t, encrypt_v1, status_t,
static status_t parse(private_encrypted_payload_t *this, chunk_t plain)
{
parser_t *parser;
payload_type_t type;
payload_type_t type = this->next_payload;
if (type != PL_NONE &&
(plain.len < 4 || untoh16(plain.ptr + 2) > plain.len))
{
DBG1(DBG_ENC, "invalid %N payload length, decryption failed?",
payload_type_names, type);
return PARSE_ERROR;
}
parser = parser_create(plain);
parser->set_major_version(parser, this->type == PLV1_ENCRYPTED ? 1 : 2);
type = this->next_payload;
while (type != PL_NONE)
{
payload_t *payload;
if (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len)
{
DBG1(DBG_ENC, "invalid %N payload length, decryption failed?",
payload_type_names, type);
parser->destroy(parser);
return PARSE_ERROR;
}
if (parser->parse_payload(parser, type, &payload) != SUCCESS)
{
parser->destroy(parser);