forked from luck/tmp_suning_uos_patched
xfrm: Fix xfrm sel prefix length validation
Family of src/dst can be different from family of selector src/dst.
Use xfrm selector family to validate address prefix length,
while verifying new sa from userspace.
Validated patch with this command:
ip xfrm state add src 1.1.6.1 dst 1.1.6.2 proto esp spi 4260196 \
reqid 20004 mode tunnel aead "rfc4106(gcm(aes))" \
0x1111016400000000000000000000000044440001 128 \
sel src 1011:1:4::2/128 sel dst 1021:1:4::2/128 dev Port5
Fixes: 07bf790895
("xfrm: Validate address prefix lengths in the xfrm selector.")
Signed-off-by: Anirudh Gupta <anirudh.gupta@sophos.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
parent
af8f3fb7fb
commit
b38ff4075a
|
@ -150,6 +150,22 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
|
|||
|
||||
err = -EINVAL;
|
||||
switch (p->family) {
|
||||
case AF_INET:
|
||||
break;
|
||||
|
||||
case AF_INET6:
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
break;
|
||||
#else
|
||||
err = -EAFNOSUPPORT;
|
||||
goto out;
|
||||
#endif
|
||||
|
||||
default:
|
||||
goto out;
|
||||
}
|
||||
|
||||
switch (p->sel.family) {
|
||||
case AF_INET:
|
||||
if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
|
||||
goto out;
|
||||
|
|
Loading…
Reference in New Issue
Block a user