ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

message: Enforce encryption except for INFORMATIONALs 

The only messages that are generally sent encrypted but could be sent
unencrypted are INFORMATIONALs (currently only used for IKEv1 and ME
connectivity checks).  This should prevent issues if the keymat_t behaves
incorrectly and does not return an aead_t when it actually should.
This commit is contained in:
Tobias Brunner 2019-04-09 11:42:19 +02:00
parent cfac7305ab
commit 7b2236526c
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/libcharon/encoding/message.c
View File

@ -1744,12 +1744,25 @@ static status_t generate_message(private_message_t *this, keymat_t *keymat,
{
aead = keymat->get_aead(keymat, FALSE);
}
if (aead && encrypting)
if (encrypting)
{
*encrypted = wrap_payloads(this);
(*encrypted)->set_transform(*encrypted, aead);
if (aead)
{
*encrypted = wrap_payloads(this);
(*encrypted)->set_transform(*encrypted, aead);
}
else if (this->exchange_type == INFORMATIONAL ||
this->exchange_type == INFORMATIONAL_V1)
{ /* allow sending unencrypted INFORMATIONALs */
encrypting = FALSE;
}
else
{
DBG1(DBG_ENC, "unable to encrypt payloads without AEAD transform");
return FAILED;
}
}
else
if (!encrypting)
{
DBG2(DBG_ENC, "not encrypting payloads");
this->is_encrypted = FALSE;