projects
/
l2tpns.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
fix segv in unhide_value
[l2tpns.git]
/
l2tpns.c
diff --git
a/l2tpns.c
b/l2tpns.c
index
6081a7f
..
b1eb66a
100644
(file)
--- a/
l2tpns.c
+++ b/
l2tpns.c
@@
-4,7
+4,7
@@
// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8
// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.1
09 2005-06-12 06:10:29
bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.1
11 2005-06-14 04:47:24
bodea Exp $";
#include <arpa/inet.h>
#include <assert.h>
#include <arpa/inet.h>
#include <assert.h>
@@
-326,7
+326,8
@@
static void initrandom(char *source)
return;
// close previous source, if any
return;
// close previous source, if any
- if (rand_fd >= 0) close(rand_fd);
+ if (rand_fd >= 0)
+ close(rand_fd);
rand_fd = -1;
rand_fd = -1;
@@
-343,13
+344,6
@@
static void initrandom(char *source)
path, strerror(errno));
}
}
path, strerror(errno));
}
}
-
- // no source: seed prng
- {
- unsigned seed = time_now ^ getpid();
- LOG(4, 0, 0, "Seeding the pseudo random generator: %u\n", seed);
- srand(seed);
- }
}
// fill buffer with random data
}
// fill buffer with random data
@@
-370,7
+364,7
@@
void random_data(uint8_t *buf, int len)
strerror(errno));
// fall back to rand()
strerror(errno));
// fall back to rand()
- initrandom(
0
);
+ initrandom(
NULL
);
}
n = 0;
}
n = 0;
@@
-2030,8
+2024,6
@@
void processudp(uint8_t * buf, int len, struct sockaddr_in *addr)
continue;
}
continue;
}
- LOG(4, s, t, "Hidden AVP\n");
-
// Unhide the AVP
unhide_value(b, n, mtype, session[s].random_vector, session[s].random_vector_length);
// Unhide the AVP
unhide_value(b, n, mtype, session[s].random_vector, session[s].random_vector_length);
@@
-2052,7
+2044,9
@@
void processudp(uint8_t * buf, int len, struct sockaddr_in *addr)
n = orig_len;
}
n = orig_len;
}
- LOG(4, s, t, " AVP %d (%s) len %d\n", mtype, avp_name(mtype), n);
+ LOG(4, s, t, " AVP %d (%s) len %d%s%s\n", mtype, avp_name(mtype), n,
+ flags & 0x40 ? ", hidden" : "", flags & 0x80 ? ", mandatory" : "");
+
switch (mtype)
{
case 0: // message type
switch (mtype)
{
case 0: // message type
@@
-2274,6
+2268,8
@@
void processudp(uint8_t * buf, int len, struct sockaddr_in *addr)
case 36: // Random Vector
LOG(4, s, t, " Random Vector received. Enabled AVP Hiding.\n");
memset(session[s].random_vector, 0, sizeof(session[s].random_vector));
case 36: // Random Vector
LOG(4, s, t, " Random Vector received. Enabled AVP Hiding.\n");
memset(session[s].random_vector, 0, sizeof(session[s].random_vector));
+ if (n > sizeof(session[s].random_vector))
+ n = sizeof(session[s].random_vector);
memcpy(session[s].random_vector, b, n);
session[s].random_vector_length = n;
break;
memcpy(session[s].random_vector, b, n);
session[s].random_vector_length = n;
break;
@@
-3929,6
+3925,13
@@
int main(int argc, char *argv[])
initrad();
initippool();
initrad();
initippool();
+ // seed prng
+ {
+ unsigned seed = time_now ^ getpid();
+ LOG(4, 0, 0, "Seeding the pseudo random generator: %u\n", seed);
+ srand(seed);
+ }
+
signal(SIGHUP, sighup_handler);
signal(SIGCHLD, sigchild_handler);
signal(SIGTERM, shutdown_handler);
signal(SIGHUP, sighup_handler);
signal(SIGCHLD, sigchild_handler);
signal(SIGTERM, shutdown_handler);
@@
-5008,11
+5011,11
@@
static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vec
uint8_t digest[16];
uint8_t *last;
size_t d = 0;
uint8_t digest[16];
uint8_t *last;
size_t d = 0;
+ uint16_t m = htons(type);
// Compute initial pad
MD5Init(&ctx);
// Compute initial pad
MD5Init(&ctx);
- MD5Update(&ctx, (uint8_t) (type >> 8) & 0xff, 1);
- MD5Update(&ctx, (uint8_t) type & 0xff, 1);
+ MD5Update(&ctx, (unsigned char *) &m, 2);
MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
MD5Update(&ctx, vector, vec_len);
MD5Final(digest, &ctx);
MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
MD5Update(&ctx, vector, vec_len);
MD5Final(digest, &ctx);