diff options
| author | Sylvain Rochet <sylvain.rochet@finsecur.com> | 2015-04-26 14:40:52 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-04-26 23:25:13 -0400 |
| commit | 325301892a2d348323e09598ae108ba26889f7f9 (patch) | |
| tree | e2dcd6f218d71c33b83fa65d217c594d774cc762 /drivers/net/ppp | |
| parent | 73b5a6f2a7a1cb78ccdec3900afc8657e11bc6bf (diff) | |
ppp: mppe: sanity error path rework
We are going to need sanity error path a little further, rework to be
able to use the sanity error path anywhere in decompressor.
Signed-off-by: Sylvain Rochet <sylvain.rochet@finsecur.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ppp')
| -rw-r--r-- | drivers/net/ppp/ppp_mppe.c | 29 |
1 files changed, 13 insertions, 16 deletions
diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c index 911b21602ff2..692ee0ff0db1 100644 --- a/drivers/net/ppp/ppp_mppe.c +++ b/drivers/net/ppp/ppp_mppe.c | |||
| @@ -478,7 +478,6 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf, | |||
| 478 | struct blkcipher_desc desc = { .tfm = state->arc4 }; | 478 | struct blkcipher_desc desc = { .tfm = state->arc4 }; |
| 479 | unsigned ccount; | 479 | unsigned ccount; |
| 480 | int flushed = MPPE_BITS(ibuf) & MPPE_BIT_FLUSHED; | 480 | int flushed = MPPE_BITS(ibuf) & MPPE_BIT_FLUSHED; |
| 481 | int sanity = 0; | ||
| 482 | struct scatterlist sg_in[1], sg_out[1]; | 481 | struct scatterlist sg_in[1], sg_out[1]; |
| 483 | 482 | ||
| 484 | if (isize <= PPP_HDRLEN + MPPE_OVHD) { | 483 | if (isize <= PPP_HDRLEN + MPPE_OVHD) { |
| @@ -514,31 +513,19 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf, | |||
| 514 | "mppe_decompress[%d]: ENCRYPTED bit not set!\n", | 513 | "mppe_decompress[%d]: ENCRYPTED bit not set!\n", |
| 515 | state->unit); | 514 | state->unit); |
| 516 | state->sanity_errors += 100; | 515 | state->sanity_errors += 100; |
| 517 | sanity = 1; | 516 | goto sanity_error; |
| 518 | } | 517 | } |
| 519 | if (!state->stateful && !flushed) { | 518 | if (!state->stateful && !flushed) { |
| 520 | printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set in " | 519 | printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set in " |
| 521 | "stateless mode!\n", state->unit); | 520 | "stateless mode!\n", state->unit); |
| 522 | state->sanity_errors += 100; | 521 | state->sanity_errors += 100; |
| 523 | sanity = 1; | 522 | goto sanity_error; |
| 524 | } | 523 | } |
| 525 | if (state->stateful && ((ccount & 0xff) == 0xff) && !flushed) { | 524 | if (state->stateful && ((ccount & 0xff) == 0xff) && !flushed) { |
| 526 | printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set on " | 525 | printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set on " |
| 527 | "flag packet!\n", state->unit); | 526 | "flag packet!\n", state->unit); |
| 528 | state->sanity_errors += 100; | 527 | state->sanity_errors += 100; |
| 529 | sanity = 1; | 528 | goto sanity_error; |
| 530 | } | ||
| 531 | |||
| 532 | if (sanity) { | ||
| 533 | if (state->sanity_errors < SANITY_MAX) | ||
| 534 | return DECOMP_ERROR; | ||
| 535 | else | ||
| 536 | /* | ||
| 537 | * Take LCP down if the peer is sending too many bogons. | ||
| 538 | * We don't want to do this for a single or just a few | ||
| 539 | * instances since it could just be due to packet corruption. | ||
| 540 | */ | ||
| 541 | return DECOMP_FATALERROR; | ||
| 542 | } | 529 | } |
| 543 | 530 | ||
| 544 | /* | 531 | /* |
| @@ -649,6 +636,16 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf, | |||
| 649 | state->sanity_errors >>= 1; | 636 | state->sanity_errors >>= 1; |
| 650 | 637 | ||
| 651 | return osize; | 638 | return osize; |
| 639 | |||
| 640 | sanity_error: | ||
| 641 | if (state->sanity_errors < SANITY_MAX) | ||
| 642 | return DECOMP_ERROR; | ||
| 643 | else | ||
| 644 | /* Take LCP down if the peer is sending too many bogons. | ||
| 645 | * We don't want to do this for a single or just a few | ||
| 646 | * instances since it could just be due to packet corruption. | ||
| 647 | */ | ||
| 648 | return DECOMP_FATALERROR; | ||
| 652 | } | 649 | } |
| 653 | 650 | ||
| 654 | /* | 651 | /* |
