Re: ipsec panic early

[Alexander Bluhm]

On Fri, May 12, 2017 at 01:53:12PM +0200, Alexander Bluhm wrote:
> In bridge_ipsec() tdb comes from
> gettdb() called with proto.  There we goto skiplookup if proto !=
> IPPROTO_ESP && proto != IPPROTO_AH && proto != IPPROTO_IPCOMP.

While looking at this, I saw the same code in the IPv4 and IPv6
case.  And we could put the panic there, too.

ok?

bluhm

Index: net/if_bridge.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_bridge.c,v
retrieving revision 1.294
diff -u -p -r1.294 if_bridge.c
--- net/if_bridge.c     5 Feb 2017 16:04:14 -0000       1.294
+++ net/if_bridge.c     12 May 2017 14:51:35 -0000
@@ -1425,17 +1425,6 @@ bridge_ipsec(struct bridge_softc *sc, st
                            sizeof(struct in_addr),
                            (caddr_t)&dst.sin.sin_addr);
 
-                       if (ip->ip_p == IPPROTO_ESP)
-                               m_copydata(m, hlen, sizeof(u_int32_t),
-                                   (caddr_t)&spi);
-                       else if (ip->ip_p == IPPROTO_AH)
-                               m_copydata(m, hlen + sizeof(u_int32_t),
-                                   sizeof(u_int32_t), (caddr_t)&spi);
-                       else if (ip->ip_p == IPPROTO_IPCOMP) {
-                               m_copydata(m, hlen + sizeof(u_int16_t),
-                                   sizeof(u_int16_t), (caddr_t)&cpi);
-                               spi = ntohl(htons(cpi));
-                       }
                        break;
 #ifdef INET6
                case AF_INET6:
@@ -1459,25 +1448,29 @@ bridge_ipsec(struct bridge_softc *sc, st
                            sizeof(struct in6_addr),
                            (caddr_t)&dst.sin6.sin6_addr);
 
-                       if (proto == IPPROTO_ESP)
-                               m_copydata(m, hlen, sizeof(u_int32_t),
-                                   (caddr_t)&spi);
-                       else if (proto == IPPROTO_AH)
-                               m_copydata(m, hlen + sizeof(u_int32_t),
-                                   sizeof(u_int32_t), (caddr_t)&spi);
-                       else if (proto == IPPROTO_IPCOMP) {
-                               m_copydata(m, hlen + sizeof(u_int16_t),
-                                   sizeof(u_int16_t), (caddr_t)&cpi);
-                               spi = ntohl(htons(cpi));
-                       }
                        break;
 #endif /* INET6 */
                default:
                        return (0);
                }
 
-               if (proto == 0)
-                       goto skiplookup;
+               switch (proto) {
+               case IPPROTO_ESP:
+                       m_copydata(m, hlen, sizeof(u_int32_t), (caddr_t)&spi);
+                       break;
+               case IPPROTO_AH:
+                       m_copydata(m, hlen + sizeof(u_int32_t),
+                           sizeof(u_int32_t), (caddr_t)&spi);
+                       break;
+               case IPPROTO_IPCOMP:
+                       m_copydata(m, hlen + sizeof(u_int16_t),
+                           sizeof(u_int16_t), (caddr_t)&cpi);
+                       spi = ntohl(htons(cpi));
+                       break;
+               default:
+                       panic("%s: unknown/unsupported security protocol %d",
+                           __func__, proto);
+               }
 
                splsoftassert(IPL_SOFTNET);