3 ms·
FreeBSD: Missing Mac validation in wg(4) packet decryption
- dchest 2mo agoLooks like it was caused by result confusion: crypto_dispatch returns errors in two different ways: https://man.freebsd.org/cgi/man.cgi?query=crypto_dispatch&apropos=0&sektion=0&manpath=FreeBSD+15.1-RELEASE+and+Ports.quarterly&format=html https://man.freebsd.org/cgi/man.cgi?query=crypto_dispatch&ap... "crypto_dispatch() returns an error if the request contained invalid fields, or zero if the request was valid." However, on an actual error from the crypto driver (e.g. invalid MAC), crypto_dispatch result is successful and the error is returned in crp_etype structure field. https://cgit.freebsd.org/src/commit/sys/dev/wg?id=34271824525e18d82c051177de265c8d8a113fb8 https://cgit.freebsd.org/src/commit/sys/dev/wg?id=3427182452...