diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2018-06-19 01:22:57 +0200 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2018-06-19 05:09:35 +0200 |
| commit | 0a8a62cbae17840ad7de35bba7fc4b04ebf76ac0 (patch) | |
| tree | 46089cb0b408909ee0dd51ce2efd5d5c9fcf0c02 /src/receive.c | |
| parent | noise: wait for crng before taking locks (diff) | |
| download | wireguard-monolithic-historical-0a8a62cbae17840ad7de35bba7fc4b04ebf76ac0.tar.xz wireguard-monolithic-historical-0a8a62cbae17840ad7de35bba7fc4b04ebf76ac0.zip | |
receive: drop handshake packets if rng is not initialized
Otherwise it's too easy to trigger cookie reply messages.
Diffstat (limited to 'src/receive.c')
| -rw-r--r-- | src/receive.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/receive.c b/src/receive.c index c5062f8..92a47c8 100644 --- a/src/receive.c +++ b/src/receive.c @@ -470,8 +470,8 @@ void packet_receive(struct wireguard_device *wg, struct sk_buff *skb) case cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE): { int cpu; - if (skb_queue_len(&wg->incoming_handshakes) > MAX_QUEUED_INCOMING_HANDSHAKES) { - net_dbg_skb_ratelimited("%s: Too many handshakes queued, dropping packet from %pISpfsc\n", wg->dev->name, skb); + if (skb_queue_len(&wg->incoming_handshakes) > MAX_QUEUED_INCOMING_HANDSHAKES || unlikely(!rng_is_initialized())) { + net_dbg_skb_ratelimited("%s: Dropping handshake packet from %pISpfsc\n", wg->dev->name, skb); goto err; } skb_queue_tail(&wg->incoming_handshakes, skb); |