Fix up ESP renegotiation reply

Really must clean up this code, but this should at least fix it for now.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

oncp.c

@@ -1223,7 +1223,7 @@ static int oncp_receive_espkeys(struct openconnect_info *vpninfo, int len)
 
 	ret = parse_conf_pkt(vpninfo, vpninfo->cstp_pkt->oncp_hdr + 2, len + 20, 301);
 	if (!ret && !setup_esp_keys(vpninfo)) {
-		unsigned char *p = vpninfo->cstp_pkt->data;
+		unsigned char *p = vpninfo->cstp_pkt->oncp_hdr + 2;
 
 		memcpy(p, esp_kmp_hdr, sizeof(esp_kmp_hdr));
 		p += sizeof(esp_kmp_hdr);
@@ -1234,6 +1234,9 @@ static int oncp_receive_espkeys(struct openconnect_info *vpninfo, int len)
 		memcpy(p, vpninfo->esp_in.secrets, sizeof(vpninfo->esp_in.secrets));
 		p += sizeof(vpninfo->esp_in.secrets);
 		vpninfo->cstp_pkt->len = p - vpninfo->cstp_pkt->data;
+		vpninfo->cstp_pkt->oncp_hdr[0] = (p - vpninfo->cstp_pkt->oncp_hdr - 2);
+		vpninfo->cstp_pkt->oncp_hdr[1] = (p - vpninfo->cstp_pkt->oncp_hdr - 2) >> 8;
+
 		queue_packet(&vpninfo->oncp_control_queue, vpninfo->cstp_pkt);
 		vpninfo->cstp_pkt = NULL;