Update to force base64 check for all SPA data
Previous to this change a check was done for base64 characters in incoming SPA data only up to MIN_SPA_DATA_SIZE. This check may be reinstantiated for SPA packets that are delivered over HTTP (and the packet data is embedded within a URL that may also contain non-base64 chars), but in the meantime the fwknopd daemon should not accept SPA packets over arbitrary ports with any non-base64 chars.
This commit is contained in:
@@ -112,10 +112,9 @@ preprocess_spa_data(fko_srv_options_t *opts, char *src_ip)
|
||||
else
|
||||
{
|
||||
/* Make sure the data is valid Base64-encoded characters
|
||||
* (at least the first MIN_SPA_DATA_SIZE bytes).
|
||||
*/
|
||||
ndx = (char *)spa_pkt->packet_data;
|
||||
for(i=0; i<MIN_SPA_DATA_SIZE; i++)
|
||||
for(i=0; i<pkt_data_len; i++)
|
||||
{
|
||||
if(!(isalnum(*ndx) || *ndx == '/' || *ndx == '+' || *ndx == '='))
|
||||
return(SPA_MSG_NOT_SPA_DATA);
|
||||
|
||||
Reference in New Issue
Block a user