diff options
| author | Hakan Olsson <ho@cvs.openbsd.org> | 2004-06-20 15:11:30 +0000 |
|---|---|---|
| committer | Hakan Olsson <ho@cvs.openbsd.org> | 2004-06-20 15:11:30 +0000 |
| commit | 7eae99d8d182ff2614e5ec769d2cbea4b8552c0a (patch) | |
| tree | a0c5d0681d24b91c8d43b3718846a1f7bb2e3955 /sbin/isakmpd | |
| parent | 163ff1f9cf6bd8f5b6797a71ec2d0f0dbff9fcde (diff) | |
Some vendors send the last Aggressive Mode message unencrypted, which we
should accept. Problem noted by alex at vbone.net. hshoexer@ ok.
Diffstat (limited to 'sbin/isakmpd')
| -rw-r--r-- | sbin/isakmpd/message.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/sbin/isakmpd/message.c b/sbin/isakmpd/message.c index 71e0004af35..dba5b806510 100644 --- a/sbin/isakmpd/message.c +++ b/sbin/isakmpd/message.c @@ -1,4 +1,4 @@ -/* $OpenBSD: message.c,v 1.79 2004/06/14 10:04:22 hshoexer Exp $ */ +/* $OpenBSD: message.c,v 1.80 2004/06/20 15:11:29 ho Exp $ */ /* $EOM: message.c,v 1.156 2000/10/10 12:36:39 provos Exp $ */ /* @@ -1368,14 +1368,20 @@ message_recv(struct message *msg) && (flags & ISAKMP_FLAGS_COMMIT)) msg->exchange->flags |= EXCHANGE_FLAG_HE_COMMITTED; - /* Require encryption as soon as we have the keystate for it. */ + /* + * Except for the 3rd Aggressive Mode message, require encryption + * as soon as we have the keystate for it. + */ if ((flags & ISAKMP_FLAGS_ENC) == 0 && - (msg->exchange->phase == 2 || msg->exchange->keystate)) { + (msg->exchange->phase == 2 || + (msg->exchange->keystate && + msg->exchange->type != ISAKMP_EXCH_AGGRESSIVE))) { log_print("message_recv: cleartext phase %d message", msg->exchange->phase); message_drop(msg, ISAKMP_NOTIFY_INVALID_FLAGS, 0, 1, 1); return -1; } + /* OK let the exchange logic do the rest. */ exchange_run(msg); |