d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

if_ovpn: reject non-UDP sockets

Browse Source 
We must ensure that the fd provided by userspace is really for a UDP
socket. If it's not we'll panic in udp_set_kernel_tunneling().

Reported by:	Gert Doering <gert@greenie.muc.de>
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2022-08-11 10:30:39 +02:00
parent 0b6d133c08
commit fd6b3bede5
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/net/if_ovpn.c
View File

@ -559,6 +559,12 @@ ovpn_new_peer(struct ifnet *ifp, const nvlist_t *nvl)
goto error_locked;
}
/* Make sure this is really a UDP socket. */
if (so->so_type != SOCK_DGRAM || so->so_proto->pr_type != SOCK_DGRAM) {
ret = EPROTOTYPE;
goto error_locked;
}
/* Must be the same socket as for other peers on this interface. */
if (sc->so != NULL && so != sc->so)
goto error_locked;