[Users] ANNOUNCE: x509-1.5.2a bug fix for freeswan-2.05 released

FreeS/WAN 2.05 introduced a new st_ph1_iv state variable which caused the IV for the encryption of notification messages sent during Main Mode to be computed incorrectly. Version 1.5.2a corrects this bug.

Regards

Andreas

Andreas Steffen                   e-mail: andreas.steffen@strongsec.com
strongSec GmbH                    home:   
http://www.strongsec.com
Alter Zürichweg 20                phone:  +41 1 730 80 64

==========================================[strong internet security]===

diff -urN freeswan-2.05-1.5.2/programs/ipsec/distro.txt freeswan-2.05-x509/programs/ipsec/distro.txt --- freeswan-2.05-1.5.2/programs/ipsec/distro.txt Sun Feb 29 16:25:29 2004 +++ freeswan-2.05-x509/programs/ipsec/distro.txt Sun Feb 29 11:34:01 2004
@@ -1 +1 @@

-X.509-1.5.2 distributed by Andreas Steffen <andreas.steffen@strongsec.com> +X.509-1.5.2a distributed by Andreas Steffen <andreas.steffen@strongsec.com> diff -urN freeswan-2.05-1.5.2/programs/pluto/Makefile freeswan-2.05-x509/programs/pluto/Makefile

--- freeswan-2.05-1.5.2/programs/pluto/Makefile	Sun Feb 29 16:25:29 2004
+++ freeswan-2.05-x509/programs/pluto/Makefile	Sun Feb 29 11:34:34 2004

 # This is the X.509 version which is made available to Pluto via the  # compile-time option -DX509
-X509_VERSION=\"X.509-1.5.2\"
+X509_VERSION=\"X.509-1.5.2a\"  

 # Uncomment this line to enable OCSP and dynamic CRL fetching using HTTP or FTP  #LIBCURL=1
diff -urN freeswan-2.05-1.5.2/programs/pluto/ipsec_doi.c freeswan-2.05-x509/programs/pluto/ipsec_doi.c

--- freeswan-2.05-1.5.2/programs/pluto/ipsec_doi.c	Sun Feb 29 16:25:29 2004
+++ freeswan-2.05-x509/programs/pluto/ipsec_doi.c	Sun Feb 29 15:44:34 2004


@@ -428,13 +428,13 @@


 	if (old_iv_len > MAX_DIGEST_LEN)
 	    impossible();
 	memcpy(old_iv, encst->st_iv, old_iv_len);

 	if (!IS_ISAKMP_SA_ESTABLISHED(encst->st_state))
 	{
 	    if (encst->st_new_iv_len > MAX_DIGEST_LEN)
 		impossible();
-	    memcpy(encst->st_iv, encst->st_new_iv, encst->st_new_iv_len);
-	    encst->st_iv_len = encst->st_new_iv_len;
+	    memcpy(encst->st_ph1_iv, encst->st_new_iv, encst->st_new_iv_len);
+	    encst->st_ph1_iv_len = encst->st_new_iv_len;
 	}
 	init_phase2_iv(encst, &msgid);
 	if (!encrypt_message(&r_hdr_pbs, encst))


@@ -1923,9 +1923,6 @@


     st->st_new_iv_len = h->hash_digest_len;
     passert(st->st_new_iv_len <= sizeof(st->st_new_iv));
 
-    DBG_cond_dump(DBG_CRYPT, "last Phase 1 IV:"
-	, st->st_iv, st->st_iv_len);
-
     h->hash_init(&ctx);
     h->hash_update(&ctx, st->st_ph1_iv, st->st_ph1_iv_len);
     passert(*msgid != 0);

_______________________________________________ FreeS/WAN Users mailing list
users@lists.freeswan.org
https://mj2.freeswan.org/cgi-bin/mj_wwwusr Received on Sun Feb 29 15:00:27 2004

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek