From 9d8192bfcd74912600abc9417e392a0cb469260e Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 2 Mar 2017 11:51:27 +0100 Subject: [PATCH] libipsec: Enforce a minimum of 256 for SPIs RFC 4303 reserves the SPIs between 1 and 255 for future use. This also avoids an overflow and a division by zero if spi_min is 0 and spi_max is 0xffffffff. --- src/libipsec/ipsec_sa_mgr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/libipsec/ipsec_sa_mgr.c b/src/libipsec/ipsec_sa_mgr.c index 314785f67e..a1fa23e287 100644 --- a/src/libipsec/ipsec_sa_mgr.c +++ b/src/libipsec/ipsec_sa_mgr.c @@ -401,7 +401,7 @@ METHOD(ipsec_sa_mgr_t, get_spi, status_t, uint32_t spi_min, spi_max, spi_new; spi_min = lib->settings->get_int(lib->settings, "%s.spi_min", - 0x00000000, lib->ns); + 0x00000100, lib->ns); spi_max = lib->settings->get_int(lib->settings, "%s.spi_max", 0xffffffff, lib->ns); if (spi_min > spi_max) @@ -410,6 +410,9 @@ METHOD(ipsec_sa_mgr_t, get_spi, status_t, spi_min = spi_max; spi_max = spi_new; } + /* make sure the SPI is valid (not in range 0-255) */ + spi_min = max(spi_min, 0x00000100); + spi_max = max(spi_max, 0x00000100); this->mutex->lock(this->mutex); if (!this->rng) @@ -433,8 +436,6 @@ METHOD(ipsec_sa_mgr_t, get_spi, status_t, return FAILED; } spi_new = spi_min + spi_new % (spi_max - spi_min + 1); - /* make sure the SPI is valid (not in range 0-255) */ - spi_new |= 0x00000100; spi_new = htonl(spi_new); } while (!allocate_spi(this, spi_new)); -- 2.47.2