Module Name: src
Committed By: riastradh
Date: Sun Jul 28 14:46:16 UTC 2024
Modified Files:
src/sys/net: if_wg.c
Log Message:
wg(4): Make sure to update endpoint on keepalive packets too.
Prompted by:
PR kern/55729: net/if_wg/t_misc:wg_rekey test case fails
PR kern/56252: wg(4) state machine has race conditions
PR kern/58463: if_wg does not work when idle.
To generate a diff of this commit:
cvs rdiff -u -r1.102 -r1.103 src/sys/net/if_wg.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_wg.c
diff -u src/sys/net/if_wg.c:1.102 src/sys/net/if_wg.c:1.103
--- src/sys/net/if_wg.c:1.102 Sun Jul 28 14:45:51 2024
+++ src/sys/net/if_wg.c Sun Jul 28 14:46:16 2024
@@ -1,4 +1,4 @@
-/* $NetBSD: if_wg.c,v 1.102 2024/07/28 14:45:51 riastradh Exp $ */
+/* $NetBSD: if_wg.c,v 1.103 2024/07/28 14:46:16 riastradh Exp $ */
/*
* Copyright (C) Ryota Ozaki <ozaki.ry...@gmail.com>
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.102 2024/07/28 14:45:51 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.103 2024/07/28 14:46:16 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_altq_enabled.h"
@@ -2857,6 +2857,15 @@ wg_handle_msg_data(struct wg_softc *wg,
wgmd = NULL;
/*
+ * The packet is genuine. Update the peer's endpoint if the
+ * source address changed.
+ *
+ * XXX How to prevent DoS by replaying genuine packets from the
+ * wrong source address?
+ */
+ wg_update_endpoint_if_necessary(wgp, src);
+
+ /*
* Validate the encapsulated packet header and get the address
* family, or drop.
*/
@@ -2866,15 +2875,6 @@ wg_handle_msg_data(struct wg_softc *wg,
goto update_state;
}
- /*
- * The packet is genuine. Update the peer's endpoint if the
- * source address changed.
- *
- * XXX How to prevent DoS by replaying genuine packets from the
- * wrong source address?
- */
- wg_update_endpoint_if_necessary(wgp, src);
-
/* Submit it into our network stack if routable. */
ok = wg_validate_route(wg, wgp, af, decrypted_buf);
if (ok) {
