the committed patch for FreeBSD 10.4 and 10.3 does not compile:

/usr/src/sys/netipsec/xform_ah.c:622:43: error: use of undeclared identifier
                    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
/usr/src/sys/netipsec/ipsec.h:323:51: note: expanded from macro 'DPRINTF'
#define DPRINTF(x)      do { if (V_ipsec_debug) printf x; } while (0)
/usr/src/sys/netipsec/xform_ah.c:625:3: error: use of undeclared identifier
                error = EACCES;
/usr/src/sys/netipsec/xform_ah.c:626:8: error: use of undeclared label 'bad'
                goto bad;
3 errors generated.
*** Error code 1

Looking at the code, the compiler is right - things have shifted here
in between FreeBSD 10 and 11, and what's working in 11 is not good for 10...
I guess we need this additional patch:

--- sys/netipsec/xform_ah.c.orig        2018-03-07 12:27:58.645874000 +0100
+++ sys/netipsec/xform_ah.c     2018-03-07 12:28:47.584073000 +0100
@@ -619,11 +619,10 @@
                DPRINTF(("%s: bad mbuf length %u (expecting %lu)"
                    " for packet in SA %s/%08lx\n", __func__,
                    m->m_pkthdr.len, (u_long) (skip + authsize + rplen),
-                   ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
+                   ipsec_address(&sav->sah->saidx.dst),
                    (u_long) ntohl(sav->spi)));
-               error = EACCES;
-               goto bad;
+               return EACCES;
        AHSTAT_ADD(ahs_ibytes, m->m_pkthdr.len - skip - hl);

But you'd better re-check, I don't know the code here - I'm just making
stuff compile :)

Further, neither this (SA-18:01) nor SA-18:02's nor the Errata Note's
(EN-18:01, EN-18:02) do show up in the given location:
https://www.freebsd.org/security/patches/SA-18%3A01/ (and the other
directories) only have the GPG signatures, but not the patches itself.


Spare Space

Attachment: signature.asc
Description: PGP signature

Reply via email to