diff options
Diffstat (limited to 'sys/netipsec/xform_ah.c')
| -rw-r--r-- | sys/netipsec/xform_ah.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/sys/netipsec/xform_ah.c b/sys/netipsec/xform_ah.c index e3da57883465..cd23fe3946cb 100644 --- a/sys/netipsec/xform_ah.c +++ b/sys/netipsec/xform_ah.c @@ -998,7 +998,9 @@ ah_output( error = EINVAL; goto bad; } - sav->replay->count++; + /* Emulate replay attack when ipsec_replay is TRUE. */ + if (!ipsec_replay) + sav->replay->count++; ah->ah_seq = htonl(sav->replay->count); } @@ -1178,6 +1180,18 @@ ah_output_cb(struct cryptop *crp) free(tc, M_XDATA); crypto_freereq(crp); + /* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */ + if (ipsec_integrity) { + int alen; + + /* + * Corrupt HMAC if we want to test integrity verification of + * the other side. + */ + alen = AUTHSIZE(sav); + m_copyback(m, m->m_pkthdr.len - alen, alen, ipseczeroes); + } + /* NB: m is reclaimed by ipsec_process_done. */ err = ipsec_process_done(m, isr); KEY_FREESAV(&sav); |