Re: samshot 2003mar13l fails to detect the CORRECT key in the DNS

-----BEGIN PGP SIGNED MESSAGE-----


| From: Hugh Daniel <[email protected]>


|   Specify while it might check for _A_ key in the reverse DNS for it's
| 'public' interfaces it never checks to see if the secret half of that
| key is in the /etc/ipsec.secrets file.  We must test for both a public
| KEY in the DNS and it's secret counterpart in ipsec.secrets or we are
| just pissing up wind.

You are quite right.

This is a bug.  Here is the fix (untested).  Actually deleting code!

Thanks,

Hugh Redelmeier
[email protected]  voice: +1 416 482-8253


Index: connections.c
===================================================================
RCS file: /freeswan/MASTER/freeswan/programs/pluto/connections.c,v
retrieving revision 1.159
diff -u -r1.159 connections.c
- --- connections.c	27 Mar 2003 05:17:39 -0000	1.159
+++ connections.c	28 Mar 2003 18:06:00 -0000
@@ -1573,7 +1573,7 @@
 		     */
 		    struct pubkeyrec *kr;
 
- -		    for (kr = ac->keys_from_dns; kr != NULL; kr = kr->next)
+		    for (kr = ac->keys_from_dns; ; kr = kr->next)
 		    {
 			if (kr == NULL)
 			{
================ end ================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBPoSQOsFAuQPManGZAQEJvQQAgAnX9ufIaKDI+lm/HHZZvRxvq5sWzwi3
hF82NsuLDRTLs34yZsqdrPBWsp7/o/DtsLIcgiH8+00N1PWHGi1gd4M9UOq2Ejgu
vdylaUPcuwsgJhS3SC5qWghj+yMcbKt+FfnTaCXd+UrufxQND85YOg5L7Jgysb/n
Scvcs0AsphA=
=DbPK
-----END PGP SIGNATURE-----