diff options
| author |   reyk <reyk@openbsd.org> | 2016-09-27 22:27:38 +0000 |
|---|---|---|
| committer | reyk <reyk@openbsd.org> | 2016-09-27 22:27:38 +0000 |
| commit | b1a3baa2130b2484ec3db102746aefefb4534e61 (patch) | |
| tree | eef6d0f34c52d3cfd95d28d1d21e0f74af7421cd | |
| parent | remove more kvm code (diff) | |
| download | wireguard-openbsd-b1a3baa2130b2484ec3db102746aefefb4534e61.tar.xz wireguard-openbsd-b1a3baa2130b2484ec3db102746aefefb4534e61.zip | |
Fix previous: don't attempt to write a NULL packet to the tap device.
Also print a debug message if the packet has been truncated by the switch.
| -rw-r--r-- | usr.sbin/switchd/ofp10.c | 19 | ||||
| -rw-r--r-- | usr.sbin/switchd/ofp13.c | 18 |
2 files changed, 25 insertions, 12 deletions
diff --git a/usr.sbin/switchd/ofp10.c b/usr.sbin/switchd/ofp10.c index 40f51a6b1b3..ad7b467ea10 100644 --- a/usr.sbin/switchd/ofp10.c +++ b/usr.sbin/switchd/ofp10.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ofp10.c,v 1.7 2016/09/27 19:40:43 reyk Exp $ */ +/* $OpenBSD: ofp10.c,v 1.8 2016/09/27 22:27:38 reyk Exp $ */ /* * Copyright (c) 2013-2016 Reyk Floeter <reyk@openbsd.org> @@ -114,7 +114,7 @@ ofp10_validate_packet_in(struct switchd *sc, { struct ofp10_packet_in *pin; uint8_t *p; - size_t len; + size_t len, plen; off_t off; off = 0; @@ -126,15 +126,22 @@ ofp10_validate_packet_in(struct switchd *sc, print_map(ntohs(pin->pin_port), ofp10_port_map), ntohs(pin->pin_total_len), pin->pin_reason); - len = ntohs(pin->pin_total_len); off += sizeof(*pin); - if ((p = ibuf_seek(ibuf, off, len)) == NULL) { - /* Buffer packets can be truncated */ + + len = ntohs(pin->pin_total_len); + plen = ibuf_length(ibuf) - off; + + if (plen < len) { + log_debug("\ttruncated packet %zu < %zu", plen, len); + + /* Buffered packets can be truncated */ if (pin->pin_buffer_id != OFP_PKTOUT_NO_BUFFER) - len = ibuf_length(ibuf) - off; + len = plen; else return (-1); } + if ((p = ibuf_seek(ibuf, off, len)) == NULL) + return (-1); if (sc->sc_tap != -1) (void)write(sc->sc_tap, p, len); diff --git a/usr.sbin/switchd/ofp13.c b/usr.sbin/switchd/ofp13.c index 0d934d7d04f..f8c1fcf2bf0 100644 --- a/usr.sbin/switchd/ofp13.c +++ b/usr.sbin/switchd/ofp13.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ofp13.c,v 1.8 2016/09/27 19:40:43 reyk Exp $ */ +/* $OpenBSD: ofp13.c,v 1.9 2016/09/27 22:27:38 reyk Exp $ */ /* * Copyright (c) 2013-2016 Reyk Floeter <reyk@openbsd.org> @@ -225,7 +225,7 @@ ofp13_validate_packet_in(struct switchd *sc, struct ofp_match *om; struct ofp_ox_match *oxm; uint8_t *p; - ssize_t len, mlen; + ssize_t len, mlen, plen; off_t moff, off; off = 0; @@ -265,17 +265,23 @@ ofp13_validate_packet_in(struct switchd *sc, break; } - /* Calculate offset from the beginning */ len = ntohs(pin->pin_total_len); - if ((p = ibuf_seek(ibuf, off, len)) == NULL) { - /* Buffer packets can be truncated */ + plen = ibuf_length(ibuf) - off; + + if (plen < len) { + log_debug("\ttruncated packet %zu < %zu", plen, len); + + /* Buffered packets can be truncated */ if (pin->pin_buffer_id != OFP_PKTOUT_NO_BUFFER) - len = ibuf_length(ibuf) - off; + len = plen; else return (-1); } + if ((p = ibuf_seek(ibuf, off, len)) == NULL) + return (-1); if (sc->sc_tap != -1) (void)write(sc->sc_tap, p, len); + return (0); } |