matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ip/xfrm: Improve transform protocol-specific parameter checking 

Ensure that only algorithms and modes supported by the transform
protocol are specified (so that errors are more obvious).

Signed-off-by: David Ward <david.ward@ll.mit.edu>
This commit is contained in:
David Ward 2013-03-25 04:23:15 +00:00 committed by Stephen Hemminger
parent ec839527f2
commit 6128fdfd5c
1 changed files with 84 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
ip/xfrm_state.c
View File

@ -486,53 +486,105 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
} }
} }
switch (req.xsinfo.mode) { if (xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
case XFRM_MODE_TRANSPORT: switch (req.xsinfo.mode) {
case XFRM_MODE_TUNNEL: case XFRM_MODE_TRANSPORT:
if (!xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) { case XFRM_MODE_TUNNEL:
fprintf(stderr, "\"mode\" is invalid with proto=%s\n", break;
case XFRM_MODE_BEET:
if (req.xsinfo.id.proto == IPPROTO_ESP)
break;
default:
fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
strxf_xfrmproto(req.xsinfo.id.proto)); strxf_xfrmproto(req.xsinfo.id.proto));
exit(1); exit(1);
} }
break;
case XFRM_MODE_ROUTEOPTIMIZATION: switch (req.xsinfo.id.proto) {
case XFRM_MODE_IN_TRIGGER: case IPPROTO_ESP:
if (!xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) { if (calgop) {
fprintf(stderr, "\"mode\" is invalid with proto=%s\n", fprintf(stderr, "ALGO-TYPE value \"%s\" is invalid with XFRM-PROTO value \"%s\"\n",
strxf_algotype(XFRMA_ALG_COMP),
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
if (!ealgop && !aeadop) {
fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
strxf_algotype(XFRMA_ALG_CRYPT),
strxf_algotype(XFRMA_ALG_AEAD),
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
break;
case IPPROTO_AH:
if (ealgop || aeadop || calgop) {
fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
strxf_algotype(XFRMA_ALG_CRYPT),
strxf_algotype(XFRMA_ALG_AEAD),
strxf_algotype(XFRMA_ALG_COMP),
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
if (!aalgop) {
fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
strxf_algotype(XFRMA_ALG_AUTH),
strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
break;
case IPPROTO_COMP:
if (ealgop || aalgop || aeadop) {
fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
strxf_algotype(XFRMA_ALG_CRYPT),
strxf_algotype(XFRMA_ALG_AUTH),
strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
strxf_algotype(XFRMA_ALG_AEAD),
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
if (!calgop) {
fprintf(stderr, "ALGO-TYPE value \"%s\" is required with XFRM-PROTO value \"%s\"\n",
strxf_algotype(XFRMA_ALG_COMP),
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
break;
}
} else {
if (ealgop || aalgop || aeadop || calgop) {
fprintf(stderr, "ALGO is invalid with XFRM-PROTO value \"%s\"\n",
strxf_xfrmproto(req.xsinfo.id.proto)); strxf_xfrmproto(req.xsinfo.id.proto));
exit(1); exit(1);
} }
break;
default:
break;
} }
if (aeadop || ealgop || aalgop || calgop) { if (xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
if (!xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) { switch (req.xsinfo.mode) {
fprintf(stderr, "\"ALGO\" is invalid with proto=%s\n", case XFRM_MODE_ROUTEOPTIMIZATION:
case XFRM_MODE_IN_TRIGGER:
break;
case 0:
fprintf(stderr, "\"mode\" is required with XFRM-PROTO value \"%s\"\n",
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
default:
fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
strxf_xfrmproto(req.xsinfo.id.proto));
exit(1);
}
if (!coap) {
fprintf(stderr, "\"coa\" is required with XFRM-PROTO value \"%s\"\n",
strxf_xfrmproto(req.xsinfo.id.proto)); strxf_xfrmproto(req.xsinfo.id.proto));
exit(1); exit(1);
} }
} else { } else {
if (xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) { if (coap) {
fprintf(stderr, "\"ALGO\" is required with proto=%s\n", fprintf(stderr, "\"coa\" is invalid with XFRM-PROTO value \"%s\"\n",
strxf_xfrmproto(req.xsinfo.id.proto));
exit (1);
}
}
if (coap) {
if (!xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
fprintf(stderr, "\"coa\" is invalid with proto=%s\n",
strxf_xfrmproto(req.xsinfo.id.proto)); strxf_xfrmproto(req.xsinfo.id.proto));
exit(1); exit(1);
} }
} else {
if (xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
fprintf(stderr, "\"coa\" is required with proto=%s\n",
strxf_xfrmproto(req.xsinfo.id.proto));
exit (1);
}
} }
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)