Date: Wed, 22 Jan 2014 12:01:48 GMT From: Luc Revardel <lrevardel@nvidia.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/185996: For IPv6, ipsec_address returns pointer to corrupted data Message-ID: <201401221201.s0MC1m2W012130@oldred.freebsd.org> Resent-Message-ID: <201401221210.s0MCA01J043636@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 185996
>Category: kern
>Synopsis: For IPv6, ipsec_address returns pointer to corrupted data
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Jan 22 12:10:00 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator: Luc Revardel
>Release: 8.4.0
>Organization:
nVidia
>Environment:
Linux 2.6.24-24-generic #1 SMP Fri Jul 24 22:46:06 UTC 2009 i686 GNU/Linux
>Description:
When INET6 is defined, ipsec_address returns a pointer to a local variable if called for an AF_INET6 address. The content of this address is unknown after returning from the function.
This leads to inconsistent display errors such as in this error message:
esp_input_cb: authentication hash mismatch for packet in SA @ƒE«/89a23692
>How-To-Repeat:
Simply call ipsec_address() with a pointer to a properly initialized sockaddr_in6.
Print the content of returned buffer after the call.
struct sockaddr_in6 in6Addr = { /***/};
char *buf;
buf = ipsec_address((union sockaddr_union*) &in6Addr);
printf("IPv6 Addr: %s\n", buf);
>Fix:
Move the logic used in inet_ntoa4 (4 static buffers) into ipsec_address so that it'll apply to both ipv4 & ipv6:
#ifdef INET
/* Return a printable string for the IPv4 address. */
static char *
inet_ntoa4(char *buf, struct in_addr ina)
{
unsigned char *ucp = (unsigned char *) &ina;
sprintf(buf, "%d.%d.%d.%d", ucp[0] & 0xff, ucp[1] & 0xff,
ucp[2] & 0xff, ucp[3] & 0xff);
return (buf);
}
#endif
/* Return a printable string for the address. */
char *
ipsec_address(union sockaddr_union* sa)
{
static char buf[4][INET6_ADDRSTRLEN]; /* ICERA_PORT */
static int i = 3;
i = (i + 1) % 4;
switch (sa->sa.sa_family) {
#ifdef INET
case AF_INET:
return (inet_ntoa4(buf[i], sa->sin.sin_addr));
#endif /* INET */
#ifdef INET6
case AF_INET6:
return (ip6_sprintf(buf[i], &sa->sin6.sin6_addr));
#endif /* INET6 */
default:
return ("(unknown address family)");
}
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201401221201.s0MC1m2W012130>