From patchwork Mon Mar 25 14:23:13 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Ward X-Patchwork-Id: 230725 X-Patchwork-Delegate: shemminger@vyatta.com Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3A8072C008A for ; Tue, 26 Mar 2013 01:23:43 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758272Ab3CYOXa (ORCPT ); Mon, 25 Mar 2013 10:23:30 -0400 Received: from MX2.LL.MIT.EDU ([129.55.12.46]:42066 "EHLO mx2.ll.mit.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756682Ab3CYOX2 (ORCPT ); Mon, 25 Mar 2013 10:23:28 -0400 Received: from LLE2K7-HUB01.mitll.ad.local (LLE2K7-HUB01.mitll.ad.local) by mx2.ll.mit.edu (unknown) with ESMTP id r2PEN2cs023593 for ; Mon, 25 Mar 2013 10:23:27 -0400 From: David Ward To: CC: David Ward Subject: [PATCH iproute2 1/7] ip/xfrm: Extend SPI validity checking Date: Mon, 25 Mar 2013 10:23:13 -0400 Message-ID: <1364221399-1024-1-git-send-email-david.ward@ll.mit.edu> X-Mailer: git-send-email 1.7.1 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.10.8626, 1.0.431, 0.0.0000 definitions=2013-03-25_03:2013-03-25, 2013-03-25, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=4 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1211240000 definitions=main-1303250108 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org A Security Policy Index (SPI) is not used with Mobile IPv6. IPComp uses a smaller 16-bit Compression Parameter Index (CPI) which is passed as the SPI value. Perform checks whenever specifying an ID. Signed-off-by: David Ward --- ip/ipxfrm.c | 12 ++++++++++++ ip/xfrm_state.c | 5 ----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index db51918..2576938 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -1067,6 +1067,18 @@ int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family, if (src.family && dst.family && (src.family != dst.family)) invarg("the same address family is required between \"src\" and \"dst\"", *argv); + if (id->spi && id->proto) { + if (xfrm_xfrmproto_is_ro(id->proto)) { + fprintf(stderr, "\"spi\" is invalid with XFRM-PROTO value \"%s\"\n", + strxf_xfrmproto(id->proto)); + exit(1); + } else if (id->proto == IPPROTO_COMP && ntohl(id->spi) >= 0x10000) { + fprintf(stderr, "SPI value is too large with XFRM-PROTO value \"%s\"\n", + strxf_xfrmproto(id->proto)); + exit(1); + } + } + if (loose == 0 && id->proto == 0) missarg("XFRM-PROTO"); if (argc == *argcp) diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index c0cf88c..3c01ec5 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -502,11 +502,6 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) strxf_xfrmproto(req.xsinfo.id.proto)); exit(1); } - if (req.xsinfo.id.spi != 0) { - fprintf(stderr, "\"spi\" must be 0 with proto=%s\n", - strxf_xfrmproto(req.xsinfo.id.proto)); - exit(1); - } break; default: break;