Page MenuHomeFreeBSD
Files F175894038

D58646.id184022.diff
No OneTemporary
Actions

D58646.id184022.diff
View Options

diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -567,36 +567,49 @@
static uma_zone_t __read_mostly ipsec_key_lft_zone;
+static int key_checksockaddrs(const struct sockaddr *src,
+ const struct sockaddr *dst);
+
/*
* set parameters into secpolicyindex buffer.
* Must allocate secpolicyindex buffer passed to this function.
*/
-#define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \
-do { \
- bzero((idx), sizeof(struct secpolicyindex)); \
- (idx)->dir = (_dir); \
- (idx)->prefs = (ps); \
- (idx)->prefd = (pd); \
- (idx)->ul_proto = (ulp); \
- bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \
- bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \
-} while (0)
+static void
+key_setsecspidx(uint8_t dir, const void *s, const void *d, uint8_t prefs,
+ uint8_t prefd, uint8_t ul_proto, struct secpolicyindex *idx)
+{
+ MPASS(key_checksockaddrs((const struct sockaddr *)s,
+ (const struct sockaddr *)d) == 0);
+
+ memset(idx, 0, sizeof(*idx));
+ idx->dir = dir;
+ idx->prefs = prefs;
+ idx->prefd = prefd;
+ idx->ul_proto = ul_proto;
+ memcpy(&idx->src, s, ((const struct sockaddr *)s)->sa_len);
+ memcpy(&idx->dst, d, ((const struct sockaddr *)d)->sa_len);
+}
/*
* set parameters into secasindex buffer.
* Must allocate secasindex buffer before calling this function.
*/
-#define KEY_SETSECASIDX(p, m, r, s, d, idx) \
-do { \
- bzero((idx), sizeof(struct secasindex)); \
- (idx)->proto = (p); \
- (idx)->mode = (m); \
- (idx)->reqid = (r); \
- bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \
- bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \
- key_porttosaddr(&(idx)->src.sa, 0); \
- key_porttosaddr(&(idx)->dst.sa, 0); \
-} while (0)
+static void
+key_setsecasidx(uint8_t proto, uint8_t mode, uint32_t reqid,
+ const void *s, const void *d, struct secasindex *idx)
+{
+ MPASS(key_checksockaddrs((const struct sockaddr *)s,
+ (const struct sockaddr *)d) == 0);
+
+ memset(idx, 0, sizeof(*idx));
+ idx->proto = proto;
+ idx->mode = mode;
+ idx->reqid = reqid;
+ memcpy(&idx->src, s, ((const struct sockaddr *)s)->sa_len);
+ memcpy(&idx->dst, d, ((const struct sockaddr *)d)->sa_len);
+ key_porttosaddr(&idx->src.sa, 0);
+ key_porttosaddr(&idx->dst.sa, 0);
+}
/* key statistics */
struct _keystat {
@@ -882,7 +895,7 @@
}
static int
-key_checksockaddrs(struct sockaddr *src, struct sockaddr *dst)
+key_checksockaddrs(const struct sockaddr *src, const struct sockaddr *dst)
{
/* family match */
@@ -1206,7 +1219,7 @@
IPSEC_ASSERT(src != NULL, ("null src address"));
IPSEC_ASSERT(dst != NULL, ("null dst address"));
- KEY_SETSECASIDX(proto, IPSEC_MODE_TUNNEL, 0, &src->sa,
+ key_setsecasidx(proto, IPSEC_MODE_TUNNEL, 0, &src->sa,
&dst->sa, &saidx);
sav = NULL;
@@ -2107,13 +2120,9 @@
return key_senderror(so, m, error);
}
/* make secindex */
- KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir,
- src0 + 1,
- dst0 + 1,
- src0->sadb_address_prefixlen,
- dst0->sadb_address_prefixlen,
- src0->sadb_address_proto,
- &spidx);
+ key_setsecspidx(xpl0->sadb_x_policy_dir, src0 + 1, dst0 + 1,
+ src0->sadb_address_prefixlen, dst0->sadb_address_prefixlen,
+ src0->sadb_address_proto, &spidx);
/* Checking there is SP already or not. */
oldsp = key_getsp(&spidx);
if (oldsp != NULL) {
@@ -2348,13 +2357,9 @@
return key_senderror(so, m, EINVAL);
}
/* make secindex */
- KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir,
- src0 + 1,
- dst0 + 1,
- src0->sadb_address_prefixlen,
- dst0->sadb_address_prefixlen,
- src0->sadb_address_proto,
- &spidx);
+ key_setsecspidx(xpl0->sadb_x_policy_dir, src0 + 1, dst0 + 1,
+ src0->sadb_address_prefixlen, dst0->sadb_address_prefixlen,
+ src0->sadb_address_proto, &spidx);
/* Is there SP in SPD ? */
if ((sp = key_getsp(&spidx)) == NULL) {
@@ -5118,7 +5123,7 @@
error = EINVAL;
goto fail;
}
- KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
/* SPI allocation */
SPI_ALLOC_LOCK();
@@ -5351,36 +5356,44 @@
const struct sadb_msghdr *mhp, struct secasvar *sav,
struct secasindex *saidx)
{
- struct sockaddr *newaddr;
+ struct sockaddr *dnewaddr, *snewaddr;
struct secashead *sah;
struct secasvar *newsav, *tmp;
struct mbuf *n;
int error, isnew;
+ bool newsaidx;
+ newsaidx = false;
/* Check that we need to change SAH */
if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) {
- newaddr = (struct sockaddr *)(
- ((struct sadb_address *)
+ snewaddr = (struct sockaddr *)(((struct sadb_address *)
mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1);
- bcopy(newaddr, &saidx->src, newaddr->sa_len);
+ newsaidx = true;
+ } else {
+ snewaddr = &saidx->src.sa;
+ }
+ if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
+ dnewaddr = (struct sockaddr *)(((struct sadb_address *)
+ mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1);
+ newsaidx = true;
+ } else {
+ dnewaddr = &saidx->dst.sa;
+ }
+ error = key_checksockaddrs(snewaddr, dnewaddr);
+ if (error != 0) {
+ ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n",
+ __func__));
+ return (error);
+ }
+ if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) {
+ memcpy(&saidx->src, snewaddr, snewaddr->sa_len);
key_porttosaddr(&saidx->src.sa, 0);
}
if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
- newaddr = (struct sockaddr *)(
- ((struct sadb_address *)
- mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1);
- bcopy(newaddr, &saidx->dst, newaddr->sa_len);
+ memcpy(&saidx->dst, dnewaddr, dnewaddr->sa_len);
key_porttosaddr(&saidx->dst.sa, 0);
}
- if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) ||
- !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
- error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa);
- if (error != 0) {
- ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n",
- __func__));
- return (error);
- }
-
+ if (newsaidx) {
sah = key_getsah(saidx);
if (sah == NULL) {
/* create a new SA index */
@@ -5637,7 +5650,7 @@
ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
return key_senderror(so, m, error);
}
- KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
sav = key_getsavbyspi(sa0->sadb_sa_spi);
if (sav == NULL) {
ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n",
@@ -5870,7 +5883,7 @@
ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
return key_senderror(so, m, error);
}
- KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
spi = sa0->sadb_sa_spi;
/*
* For TCP-MD5 SAs we don't use SPI. Check the uniqueness using
@@ -6325,7 +6338,7 @@
ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
return (key_senderror(so, m, EINVAL));
}
- KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
+ key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) {
/*
* Caller wants us to delete all non-LARVAL SAs
@@ -6556,7 +6569,7 @@
ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
return key_senderror(so, m, EINVAL);
}
- KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
+ key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
SPI_ALLOC_LOCK();
if (proto == IPPROTO_TCP)
@@ -7373,7 +7386,7 @@
ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
return key_senderror(so, m, EINVAL);
}
- KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
/* get a SA index */
SAHTREE_RLOCK();
diff --git a/sys/netipsec/xform_ipcomp.c b/sys/netipsec/xform_ipcomp.c
--- a/sys/netipsec/xform_ipcomp.c
+++ b/sys/netipsec/xform_ipcomp.c
@@ -722,7 +722,7 @@
return (0);
bzero(&src, sizeof(src));
bzero(&dst, sizeof(dst));
- src.sa.sa_family = dst.sa.sa_family = AF_INET;
+ src.sa.sa_family = dst.sa.sa_family = AF_INET6;
src.sin6.sin6_len = dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
ip6 = mtod(m, const struct ip6_hdr *);
src.sin6.sin6_addr = ip6->ip6_src;

File Metadata

Mime Type
text/plain
Expires
Thu, Oct 15, 7:01 AM (12 m, 36 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
40810236
Default Alt Text
D58646.id184022.diff (8 KB)

Event Timeline