From 8db2374fc4e71eb0580030fd021e259868bb7bff Mon Sep 17 00:00:00 2001 From: "Bjoern A. Zeeb" Date: Sat, 16 Jun 2007 09:25:23 +0000 Subject: 'spi' and the return value of ntohl are unsigned. Remove the extra >=0 check which was always true. Document the special meaning of spi values of 0 and 1-255 with a comment. Found with: Coverity Prevent(tm) CID: 2047 --- sys/netipsec/key.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'sys/netipsec/key.c') diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index bd25513301c5..cb0284cd2e19 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -3209,7 +3209,12 @@ key_mature(struct secasvar *sav) switch (sav->sah->saidx.proto) { case IPPROTO_ESP: case IPPROTO_AH: - if (ntohl(sav->spi) >= 0 && ntohl(sav->spi) <= 255) { + /* + * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values + * 1-255 reserved by IANA for future use, + * 0 for implementation specific, local use. + */ + if (ntohl(sav->spi) <= 255) { ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n", __func__, (u_int32_t)ntohl(sav->spi))); return EINVAL; -- cgit v1.2.3