Import upstream release 5.2.1

5 files changed, 33 insertions, 1 deletions

diff --git a/src/libtls/Makefile.in b/src/libtls/Makefile.in
index 85f13d0c8..426d8bcb3 100644
--- a/src/libtls/Makefile.in
+++ b/src/libtls/Makefile.in
@@ -284,6 +284,7 @@ ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+GEM = @GEM@
 GENHTML = @GENHTML@
 GPERF = @GPERF@
 GPRBUILD = @GPRBUILD@
@@ -344,6 +345,7 @@ PYTHON_VERSION = @PYTHON_VERSION@
 RANLIB = @RANLIB@
 RTLIB = @RTLIB@
 RUBY = @RUBY@
+RUBYGEMDIR = @RUBYGEMDIR@
 RUBYINCLUDE = @RUBYINCLUDE@
 RUBYLIB = @RUBYLIB@
 SED = @SED@
@@ -409,6 +411,8 @@ ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
+json_CFLAGS = @json_CFLAGS@
+json_LIBS = @json_LIBS@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -456,6 +460,10 @@ strongswan_conf = @strongswan_conf@
 strongswan_options = @strongswan_options@
 swanctldir = @swanctldir@
 sysconfdir = @sysconfdir@
+systemd_daemon_CFLAGS = @systemd_daemon_CFLAGS@
+systemd_daemon_LIBS = @systemd_daemon_LIBS@
+systemd_journal_CFLAGS = @systemd_journal_CFLAGS@
+systemd_journal_LIBS = @systemd_journal_LIBS@
 systemdsystemunitdir = @systemdsystemunitdir@
 t_plugins = @t_plugins@
 target_alias = @target_alias@
diff --git a/src/libtls/tests/Makefile.in b/src/libtls/tests/Makefile.in
index bbc364970..2e44fb4a5 100644
--- a/src/libtls/tests/Makefile.in
+++ b/src/libtls/tests/Makefile.in
@@ -229,6 +229,7 @@ ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+GEM = @GEM@
 GENHTML = @GENHTML@
 GPERF = @GPERF@
 GPRBUILD = @GPRBUILD@
@@ -289,6 +290,7 @@ PYTHON_VERSION = @PYTHON_VERSION@
 RANLIB = @RANLIB@
 RTLIB = @RTLIB@
 RUBY = @RUBY@
+RUBYGEMDIR = @RUBYGEMDIR@
 RUBYINCLUDE = @RUBYINCLUDE@
 RUBYLIB = @RUBYLIB@
 SED = @SED@
@@ -354,6 +356,8 @@ ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
+json_CFLAGS = @json_CFLAGS@
+json_LIBS = @json_LIBS@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -401,6 +405,10 @@ strongswan_conf = @strongswan_conf@
 strongswan_options = @strongswan_options@
 swanctldir = @swanctldir@
 sysconfdir = @sysconfdir@
+systemd_daemon_CFLAGS = @systemd_daemon_CFLAGS@
+systemd_daemon_LIBS = @systemd_daemon_LIBS@
+systemd_journal_CFLAGS = @systemd_journal_CFLAGS@
+systemd_journal_LIBS = @systemd_journal_LIBS@
 systemdsystemunitdir = @systemdsystemunitdir@
 t_plugins = @t_plugins@
 target_alias = @target_alias@
diff --git a/src/libtls/tls_aead.c b/src/libtls/tls_aead.c
index 1d0779dc0..67cfd3a75 100644
--- a/src/libtls/tls_aead.c
+++ b/src/libtls/tls_aead.c
@@ -82,6 +82,7 @@ METHOD(tls_aead_t, encrypt, bool,
 	assoc = chunk_from_thing(hdr);
 	if (!this->aead->encrypt(this->aead, plain, assoc, iv, NULL))
 	{
+		chunk_free(&encrypted);
 		return FALSE;
 	}
 	chunk_free(data);
diff --git a/src/libtls/tls_aead_expl.c b/src/libtls/tls_aead_expl.c
index 5e4d33e14..80b0db38c 100644
--- a/src/libtls/tls_aead_expl.c
+++ b/src/libtls/tls_aead_expl.c
@@ -91,7 +91,6 @@ METHOD(tls_aead_t, encrypt, bool,
 	/* encrypt inline */
 	if (!this->crypter->encrypt(this->crypter, *data, iv, NULL))
 	{
-		free(data->ptr);
 		return FALSE;
 	}
 	/* prepend IV */
@@ -106,6 +105,7 @@ METHOD(tls_aead_t, decrypt, bool,
 	chunk_t assoc, mac, iv;
 	u_int8_t bs, padlen;
 	sigheader_t hdr;
+	size_t i;
 
 	iv.len = this->crypter->get_iv_size(this->crypter);
 	if (data->len < iv.len)
@@ -126,6 +126,13 @@ METHOD(tls_aead_t, decrypt, bool,
 	padlen = data->ptr[data->len - 1];
 	if (padlen < data->len)
 	{	/* If padding looks valid, remove it */
+		for (i = data->len - padlen - 1; i < data->len - 1; i++)
+		{
+			if (data->ptr[i] != padlen)
+			{
+				return FALSE;
+			}
+		}
 		data->len -= padlen + 1;
 	}
 
diff --git a/src/libtls/tls_aead_impl.c b/src/libtls/tls_aead_impl.c
index fb14026e0..d529ceba7 100644
--- a/src/libtls/tls_aead_impl.c
+++ b/src/libtls/tls_aead_impl.c
@@ -100,6 +100,7 @@ METHOD(tls_aead_t, decrypt, bool,
 	chunk_t assoc, mac, iv;
 	u_int8_t bs, padlen;
 	sigheader_t hdr;
+	size_t i;
 
 	bs = this->crypter->get_block_size(this->crypter);
 	if (data->len < bs || data->len < this->iv.len || data->len % bs)
@@ -116,6 +117,13 @@ METHOD(tls_aead_t, decrypt, bool,
 	padlen = data->ptr[data->len - 1];
 	if (padlen < data->len)
 	{	/* If padding looks valid, remove it */
+		for (i = data->len - padlen - 1; i < data->len - 1; i++)
+		{
+			if (data->ptr[i] != padlen)
+			{
+				return FALSE;
+			}
+		}
 		data->len -= padlen + 1;
 	}