diff options
| author |   tobhe <tobhe@openbsd.org> | 2020-12-14 20:20:06 +0000 |
|---|---|---|
| committer | tobhe <tobhe@openbsd.org> | 2020-12-14 20:20:06 +0000 |
| commit | bcde35739792465dadd02b5f928e2239a21a2e7a (patch) | |
| tree | 04a4a84f3c4e9fb7caa50e8bfdb88ea4fed72eef /sys/net/pfkeyv2.c | |
| parent | Fix SSL_get{,_peer}_finished() with TLSv1.3 (diff) | |
| download | wireguard-openbsd-bcde35739792465dadd02b5f928e2239a21a2e7a.tar.xz wireguard-openbsd-bcde35739792465dadd02b5f928e2239a21a2e7a.zip | |
Make sure that the address families of a flow's source address,
destination address and their netmasks match, otherwise return EINVAL.
ok bluhm@ patrick@
Diffstat (limited to 'sys/net/pfkeyv2.c')
| -rw-r--r-- | sys/net/pfkeyv2.c | 30 |
1 files changed, 23 insertions, 7 deletions
diff --git a/sys/net/pfkeyv2.c b/sys/net/pfkeyv2.c index de6f91aee0d..a757bf04d8e 100644 --- a/sys/net/pfkeyv2.c +++ b/sys/net/pfkeyv2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfkeyv2.c,v 1.207 2020/08/28 12:43:59 tobhe Exp $ */ +/* $OpenBSD: pfkeyv2.c,v 1.208 2020/12/14 20:20:06 tobhe Exp $ */ /* * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 @@ -1339,13 +1339,19 @@ pfkeyv2_send(struct socket *so, void *message, int len) newsa->tdb_ids_swapped, headers[SADB_EXT_IDENTITY_SRC], headers[SADB_EXT_IDENTITY_DST]); - import_flow(&newsa->tdb_filter, &newsa->tdb_filtermask, + if ((rval = import_flow(&newsa->tdb_filter, + &newsa->tdb_filtermask, headers[SADB_X_EXT_SRC_FLOW], headers[SADB_X_EXT_SRC_MASK], headers[SADB_X_EXT_DST_FLOW], headers[SADB_X_EXT_DST_MASK], headers[SADB_X_EXT_PROTOCOL], - headers[SADB_X_EXT_FLOW_TYPE]); + headers[SADB_X_EXT_FLOW_TYPE]))) { + tdb_free(freeme); + freeme = NULL; + NET_UNLOCK(); + goto ret; + } import_udpencap(newsa, headers[SADB_X_EXT_UDPENCAP]); import_rdomain(newsa, headers[SADB_X_EXT_RDOMAIN]); #if NPF > 0 @@ -1511,13 +1517,19 @@ pfkeyv2_send(struct socket *so, void *message, int len) headers[SADB_EXT_IDENTITY_SRC], headers[SADB_EXT_IDENTITY_DST]); - import_flow(&newsa->tdb_filter, &newsa->tdb_filtermask, + if ((rval = import_flow(&newsa->tdb_filter, + &newsa->tdb_filtermask, headers[SADB_X_EXT_SRC_FLOW], headers[SADB_X_EXT_SRC_MASK], headers[SADB_X_EXT_DST_FLOW], headers[SADB_X_EXT_DST_MASK], headers[SADB_X_EXT_PROTOCOL], - headers[SADB_X_EXT_FLOW_TYPE]); + headers[SADB_X_EXT_FLOW_TYPE]))) { + tdb_free(freeme); + freeme = NULL; + NET_UNLOCK(); + goto ret; + } import_udpencap(newsa, headers[SADB_X_EXT_UDPENCAP]); import_rdomain(newsa, headers[SADB_X_EXT_RDOMAIN]); #if NPF > 0 @@ -1830,10 +1842,14 @@ pfkeyv2_send(struct socket *so, void *message, int len) else ssrc = NULL; - import_flow(&encapdst, &encapnetmask, + if ((rval = import_flow(&encapdst, &encapnetmask, headers[SADB_X_EXT_SRC_FLOW], headers[SADB_X_EXT_SRC_MASK], headers[SADB_X_EXT_DST_FLOW], headers[SADB_X_EXT_DST_MASK], - headers[SADB_X_EXT_PROTOCOL], headers[SADB_X_EXT_FLOW_TYPE]); + headers[SADB_X_EXT_PROTOCOL], + headers[SADB_X_EXT_FLOW_TYPE]))) { + NET_UNLOCK(); + goto ret; + } /* Determine whether the exact same SPD entry already exists. */ if ((rn = rn_match(&encapdst, rnh)) != NULL) { |