resetting manifest requested domain to floor

[platform/upstream/openconnect.git] / dtls.c

diff --git a/dtls.c b/dtls.c
index 5916daa..9c21a3f 100644 (file)
--- a/dtls.c
+++ b/dtls.c
@@ -410,7 +410,7 @@ int dtls_try_handshake(struct openconnect_info *vpninfo)
 #ifdef HAVE_GNUTLS_DTLS_SET_DATA_MTU
                /* Make sure GnuTLS's idea of the MTU is sufficient to take
                   a full VPN MTU (with 1-byte header) in a data record. */
-               err = gnutls_dtls_set_data_mtu(vpninfo->new_dtls_ssl, vpninfo->mtu + 1);
+               err = gnutls_dtls_set_data_mtu(vpninfo->new_dtls_ssl, vpninfo->actual_mtu + 1);
                if (err) {
                        vpn_progress(vpninfo, PRG_ERR,
                                     _("Failed to set DTLS MTU: %s\n"),
@@ -423,7 +423,7 @@ int dtls_try_handshake(struct openconnect_info *vpninfo)
                   We only support AES128-CBC and DES-CBC3-SHA anyway, so
                   working out the worst case isn't hard. */
                gnutls_dtls_set_mtu(vpninfo->new_dtls_ssl,
-                                   vpninfo->mtu + 1 /* packet + header */
+                                   vpninfo->actual_mtu + 1 /* packet + header */
                                    + 13 /* DTLS header */
                                    + 20 /* biggest supported MAC (SHA1) */
                                    + 16 /* biggest supported IV (AES-128) */
@@ -520,18 +520,21 @@ int connect_dtls_socket(struct openconnect_info *vpninfo)
        }
 
        if (vpninfo->dtls_local_port) {
-               struct sockaddr_storage dtls_bind_addr;
+               union {
+                       struct sockaddr_in in;
+                       struct sockaddr_in6 in6;
+               } dtls_bind_addr;
                int dtls_bind_addrlen;
                memset(&dtls_bind_addr, 0, sizeof(dtls_bind_addr));
 
                if (vpninfo->peer_addr->sa_family == AF_INET) {
-                       struct sockaddr_in *addr = (struct sockaddr_in *)&dtls_bind_addr;
+                       struct sockaddr_in *addr = &dtls_bind_addr.in;
                        dtls_bind_addrlen = sizeof(*addr);
                        addr->sin_family = AF_INET;
                        addr->sin_addr.s_addr = INADDR_ANY;
                        addr->sin_port = htons(vpninfo->dtls_local_port);
                } else if (vpninfo->peer_addr->sa_family == AF_INET6) {
-                       struct sockaddr_in6 *addr = (struct sockaddr_in6 *)&dtls_bind_addr;
+                       struct sockaddr_in6 *addr = &dtls_bind_addr.in6;
                        dtls_bind_addrlen = sizeof(*addr);
                        addr->sin6_family = AF_INET6;
                        addr->sin6_addr = in6addr_any;
@@ -541,11 +544,13 @@ int connect_dtls_socket(struct openconnect_info *vpninfo)
                                     _("Unknown protocol family %d. Cannot do DTLS\n"),
                                     vpninfo->peer_addr->sa_family);
                        vpninfo->dtls_attempt_period = 0;
+                       close(dtls_fd);
                        return -EINVAL;
                }
 
                if (bind(dtls_fd, (struct sockaddr *)&dtls_bind_addr, dtls_bind_addrlen)) {
                        perror(_("Bind UDP socket for DTLS"));
+                       close(dtls_fd);
                        return -EINVAL;
                }
        }
@@ -676,7 +681,7 @@ int dtls_mainloop(struct openconnect_info *vpninfo, int *timeout)
        char magic_pkt;
 
        while (1) {
-               int len = vpninfo->mtu;
+               int len = vpninfo->actual_mtu;
                unsigned char *buf;
 
                if (!dtls_pkt) {