diff options
Diffstat (limited to 'src/receive.c')
| -rw-r--r-- | src/receive.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/receive.c b/src/receive.c index b582d00..5807465 100644 --- a/src/receive.c +++ b/src/receive.c @@ -237,10 +237,15 @@ void packet_consume_data_done(struct sk_buff *skb, struct wireguard_peer *peer, skb->dev = dev; skb->ip_summed = CHECKSUM_UNNECESSARY; if (skb->len >= sizeof(struct iphdr) && ip_hdr(skb)->version == 4) { + len = ntohs(ip_hdr(skb)->tot_len); + if (unlikely(len < sizeof(struct iphdr))) + goto dishonest_packet_size; skb->protocol = htons(ETH_P_IP); if (INET_ECN_is_ce(PACKET_CB(skb)->ds)) IP_ECN_set_ce(ip_hdr(skb)); + } else if (skb->len >= sizeof(struct ipv6hdr) && ip_hdr(skb)->version == 6) { + len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr); skb->protocol = htons(ETH_P_IPV6); if (INET_ECN_is_ce(PACKET_CB(skb)->ds)) IP6_ECN_set_ce(skb, ipv6_hdr(skb)); @@ -251,6 +256,16 @@ void packet_consume_data_done(struct sk_buff *skb, struct wireguard_peer *peer, goto packet_processed; } + if (unlikely(len > skb->len)) { +dishonest_packet_size: + net_dbg_ratelimited("%s: Packet is lying about its size from peer %Lu (%pISpfsc)\n", netdev_pub(peer->device)->name, peer->internal_id, &peer->endpoint.addr); + ++dev->stats.rx_errors; + ++dev->stats.rx_length_errors; + goto packet_processed; + } + if (len < skb->len && pskb_trim(skb, len)) + goto packet_processed; + timers_data_received(peer); routed_peer = routing_table_lookup_src(&wg->peer_routing_table, skb); |