Module Name: src
Committed By: riastradh
Date: Sun Jul 28 14:45:33 UTC 2024
Modified Files:
src/sys/net: if_wg.c
Log Message:
wg(4): Reject rx on sessions older than reject-after-time sec.
Prompted by (but won't fix anything in):
PR kern/55729: net/if_wg/t_misc:wg_rekey test case fails
PR kern/56252: wg(4) state machine has race conditions
PR kern/58463: if_wg does not work when idle.
To generate a diff of this commit:
cvs rdiff -u -r1.100 -r1.101 src/sys/net/if_wg.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_wg.c
diff -u src/sys/net/if_wg.c:1.100 src/sys/net/if_wg.c:1.101
--- src/sys/net/if_wg.c:1.100 Sun Jul 28 14:40:02 2024
+++ src/sys/net/if_wg.c Sun Jul 28 14:45:33 2024
@@ -1,4 +1,4 @@
-/* $NetBSD: if_wg.c,v 1.100 2024/07/28 14:40:02 riastradh Exp $ */
+/* $NetBSD: if_wg.c,v 1.101 2024/07/28 14:45:33 riastradh Exp $ */
/*
* Copyright (C) Ryota Ozaki <[email protected]>
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.100 2024/07/28 14:40:02 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.101 2024/07/28 14:45:33 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_altq_enabled.h"
@@ -2693,6 +2693,7 @@ wg_handle_msg_data(struct wg_softc *wg,
struct wg_session *wgs;
struct wg_peer *wgp;
int state;
+ time_t age;
size_t mlen;
struct psref psref;
int error, af;
@@ -2736,6 +2737,16 @@ wg_handle_msg_data(struct wg_softc *wg,
}
/*
+ * Reject if the session is too old.
+ */
+ age = time_uptime - wgs->wgs_time_established;
+ if (__predict_false(age >= wg_reject_after_time)) {
+ WG_DLOG("session %"PRIx32" too old, %"PRIuMAX" sec\n",
+ wgmd->wgmd_receiver, (uintmax_t)age);
+ goto out;
+ }
+
+ /*
* Get the peer, for rate-limited logs (XXX MPSAFE, dtrace) and
* to update the endpoint if authentication succeeds.
*/
