From 5ba9f1ecf9f70acae3209841ee9ecaeb8e954bfc Mon Sep 17 00:00:00 2001 From: Damien Stuart Date: Sun, 28 Jun 2009 18:19:24 +0000 Subject: [PATCH] Fixed spa access message validation routine to allow for multiple comma-separated requests in one message. git-svn-id: file:///home/mbr/svn/fwknop/trunk@108 510a4753-2344-4c79-9c09-4d669213fbeb --- fko/fko_message.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/fko/fko_message.c b/fko/fko_message.c index c9065373..9b6b33db 100644 --- a/fko/fko_message.c +++ b/fko/fko_message.c @@ -32,6 +32,7 @@ */ int validate_cmd_msg(const char *msg); int validate_access_msg(const char *msg); +int validate_proto_port_spec(const char *msg); int validate_nat_access_msg(const char *msg); int got_allow_ip(const char *msg); @@ -177,7 +178,7 @@ validate_cmd_msg(const char *msg) int validate_access_msg(const char *msg) { - const char *ndx; + const char *ndx, *ndx2; int res = FKO_SUCCESS; int startlen = strlen(msg); @@ -193,7 +194,23 @@ validate_access_msg(const char *msg) if(ndx == NULL || (1+(ndx - msg)) >= startlen) return(FKO_ERROR_INVALID_SPA_ACCESS_MSG); - ndx++; + /* Look for a comma to see if this is a multi-part access request. + */ + do { + ndx++; + res = validate_proto_port_spec(ndx); + } while(ndx = strchr(ndx, ',')); + + return(res); +} + +int +validate_proto_port_spec(const char *msg) +{ + int res = FKO_SUCCESS; + int startlen = strlen(msg); + + const char *ndx = msg; /* Now check for proto/port string. Currenly we only allow protos * 'tcp', 'udp', and 'icmp'.