denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Add some sanity checks when processing kernel events

Browse Source 
These are always set in kernel messages, but just make sure so static
analyzers like SonarQube are happy.
This commit is contained in:
Tobias Brunner
2026-04-23 15:21:45 +02:00
parent 0a64c27a1f
commit 4821758d46
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+18 -3
View File
@@ -1355,7 +1355,7 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this,
reqid = response.x_sa2->sadb_x_sa2_reqid;
mode = response.x_sa2->sadb_x_sa2_mode;
}
else
else if (response.x_policy)
{
index = response.x_policy->sadb_x_policy_id;
this->mutex->lock(this->mutex);
@@ -1373,6 +1373,11 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this,
}
this->mutex->unlock(this->mutex);
}
else
{
DBG1(DBG_KNL, "received SADB_ACQUIRE is missing required information");
return;
}
if (reqid)
{
@@ -1384,7 +1389,7 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this,
* only useful in transport mode with wildcard policies. in tunnel mode,
* where narrowing could occur and the sequence number would be
* relevant, these TS are useless and might not even match the policy */
if (mode == IPSEC_MODE_TRANSPORT)
if (mode == IPSEC_MODE_TRANSPORT && response.src && response.dst)
{
data.src = sadb_address2ts(response.src);
data.dst = sadb_address2ts(response.dst);
@@ -1416,12 +1421,17 @@ static void process_expire(private_kernel_pfkey_ipsec_t *this,
DBG1(DBG_KNL, "parsing SADB_EXPIRE from kernel failed");
return;
}
if (!response.sa)
{
DBG1(DBG_KNL, "received SADB_EXPIRE is missing required information");
return;
}
protocol = satype2proto(msg->sadb_msg_satype);
spi = response.sa->sadb_sa_spi;
hard = response.lft_hard != NULL;
if (protocol == IPPROTO_ESP || protocol == IPPROTO_AH)
if ((protocol == IPPROTO_ESP || protocol == IPPROTO_AH) && response.dst)
{
dst = host_create_from_sockaddr((sockaddr_t*)(response.dst + 1));
if (dst)
@@ -1452,6 +1462,11 @@ static void process_migrate(private_kernel_pfkey_ipsec_t *this,
DBG1(DBG_KNL, "parsing SADB_X_MIGRATE from kernel failed");
return;
}
if (!response.src || !response.dst || !response.x_policy)
{
DBG1(DBG_KNL, "received SADB_X_MIGRATE is missing required information");
return;
}
src_ts = sadb_address2ts(response.src);
dst_ts = sadb_address2ts(response.dst);
dir = kernel2dir(response.x_policy->sadb_x_policy_dir);