The payloads are layered like onions, so you can validate one layer and
authorpatrick <patrick@openbsd.org>
Mon, 4 Dec 2017 16:52:16 +0000 (16:52 +0000)
committerpatrick <patrick@openbsd.org>
Mon, 4 Dec 2017 16:52:16 +0000 (16:52 +0000)
commit453c4015b77f81e940e22e3ac42b969c85510b0c
tree6d154e51fd2425e58e4617c8a1be6389a59a8774
parent441055dec26ba16cdd03b472cae28272b1a83141
The payloads are layered like onions, so you can validate one layer and
then call the next one, which can then validate itself.  Thing is, most
layers try to run validations on the upper layer, which is not useful
and rather confusing.  This cleans it up.

First change is that the generic payload parser does not anymore pass
the length of the whole datagram, including all remaining payloads, but
passes only the length of the specific payload to the specific payload
parser.  Second change is that the payload validators don't check the
length of the upper layer, but only verify their own lengths.

Diff discussed with hshoexer@ and sthen@
Tested by sthen@
sbin/iked/ikev2_pld.c