l2tp: remove l2specific_len dependency in l2tp_core
commit 62e7b6a57c
upstream.
Remove l2specific_len dependency while building l2tpv3 header or
parsing the received frame since default L2-Specific Sublayer is
always four bytes long and we don't need to rely on a user supplied
value.
Moreover in l2tp netlink code there are no sanity checks to
enforce the relation between l2specific_len and l2specific_type,
so sending a malformed netlink message is possible to set
l2specific_type to L2TP_L2SPECTYPE_DEFAULT (or even
L2TP_L2SPECTYPE_NONE) and set l2specific_len to a value greater than
4 leaking memory on the wire and sending corrupted frames.
Reviewed-by: Guillaume Nault <g.nault@alphalink.fr>
Tested-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Родитель
556e554a3b
Коммит
a12098dd9f
|
@ -758,11 +758,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
|
|||
"%s: recv data ns=%u, session nr=%u\n",
|
||||
session->name, ns, session->nr);
|
||||
}
|
||||
ptr += 4;
|
||||
}
|
||||
|
||||
/* Advance past L2-specific header, if present */
|
||||
ptr += session->l2specific_len;
|
||||
|
||||
if (L2TP_SKB_CB(skb)->has_seq) {
|
||||
/* Received a packet with sequence numbers. If we're the LNS,
|
||||
* check if we sre sending sequence numbers and if not,
|
||||
|
@ -1084,9 +1082,9 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
|
|||
memcpy(bufp, &session->cookie[0], session->cookie_len);
|
||||
bufp += session->cookie_len;
|
||||
}
|
||||
if (session->l2specific_len) {
|
||||
if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
|
||||
u32 l2h = 0;
|
||||
|
||||
if (session->send_seq) {
|
||||
l2h = 0x40000000 | session->ns;
|
||||
session->ns++;
|
||||
|
@ -1096,9 +1094,8 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
|
|||
session->name, session->ns);
|
||||
}
|
||||
|
||||
*((__be32 *) bufp) = htonl(l2h);
|
||||
}
|
||||
bufp += session->l2specific_len;
|
||||
*((__be32 *)bufp) = htonl(l2h);
|
||||
bufp += 4;
|
||||
}
|
||||
|
||||
return bufp - optr;
|
||||
|
@ -1764,7 +1761,7 @@ int l2tp_session_delete(struct l2tp_session *session)
|
|||
EXPORT_SYMBOL_GPL(l2tp_session_delete);
|
||||
|
||||
/* We come here whenever a session's send_seq, cookie_len or
|
||||
* l2specific_len parameters are set.
|
||||
* l2specific_type parameters are set.
|
||||
*/
|
||||
void l2tp_session_set_header_len(struct l2tp_session *session, int version)
|
||||
{
|
||||
|
@ -1773,7 +1770,8 @@ void l2tp_session_set_header_len(struct l2tp_session *session, int version)
|
|||
if (session->send_seq)
|
||||
session->hdr_len += 4;
|
||||
} else {
|
||||
session->hdr_len = 4 + session->cookie_len + session->l2specific_len;
|
||||
session->hdr_len = 4 + session->cookie_len;
|
||||
session->hdr_len += l2tp_get_l2specific_len(session);
|
||||
if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
|
||||
session->hdr_len += 4;
|
||||
}
|
||||
|
|
|
@ -320,6 +320,17 @@ do { \
|
|||
#define l2tp_session_dec_refcount(s) l2tp_session_dec_refcount_1(s)
|
||||
#endif
|
||||
|
||||
static inline int l2tp_get_l2specific_len(struct l2tp_session *session)
|
||||
{
|
||||
switch (session->l2specific_type) {
|
||||
case L2TP_L2SPECTYPE_DEFAULT:
|
||||
return 4;
|
||||
case L2TP_L2SPECTYPE_NONE:
|
||||
default:
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
#define l2tp_printk(ptr, type, func, fmt, ...) \
|
||||
do { \
|
||||
if (((ptr)->debug) & (type)) \
|
||||
|
|
Загрузка…
Ссылка в новой задаче