From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 20 Mar 2015 15:32:56 +0000 (+0100)
Subject: encoding: Don't verify length of IKEv1 KE payloads
X-Git-Tag: 5.3.0rc1~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ed5f569;p=thirdparty%2Fstrongswan.git

encoding: Don't verify length of IKEv1 KE payloads

The verification introduced with 84738b1aed95 ("encoding: Verify the length
of KE payload data for known groups") can't be done for IKEv1 as the KE
payload does not contain the DH group.
---

diff --git a/src/libcharon/encoding/payloads/ke_payload.c b/src/libcharon/encoding/payloads/ke_payload.c
index 644b5b6f91..7f3c4e400a 100644
--- a/src/libcharon/encoding/payloads/ke_payload.c
+++ b/src/libcharon/encoding/payloads/ke_payload.c
@@ -146,6 +146,12 @@ METHOD(payload_t, verify, status_t,
 	diffie_hellman_group_t g = this->dh_group_number;
 	bool valid = TRUE;
 
+	if (this->type == PLV1_KEY_EXCHANGE)
+	{
+		/* IKEv1 does not transmit the group */
+		return SUCCESS;
+	}
+
 	switch (g)
 	{
 		case MODP_NONE: