Commit 3be9b352 authored by Alexis Dambricourt's avatar Alexis Dambricourt Committed by Jason Wang
Browse files

l2tpv3: fix cookie decoding 



If a 32 bits l2tpv3 frame cookie MSB if set to 1, the cast to uint64_t
cookie will spread 1 to the four most significant bytes.
Then the condition (cookie != s->rx_cookie) becomes false.

Signed-off-by: default avatarAlexis Dambricourt <alexis.dambricourt@gmail.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent aa7f9966

net/l2tpv3.c

+1 −1
Original line number Diff line number Diff line
@@ -325,7 +325,7 @@ static int l2tpv3_verify_header(NetL2TPV3State *s, uint8_t *buf) 
        if (s->cookie_is_64) {

            cookie = ldq_be_p(buf + s->cookie_offset);

        } else {

            cookie = ldl_be_p(buf + s->cookie_offset);

            cookie = ldl_be_p(buf + s->cookie_offset) & 0xffffffffULL;

        }

        if (cookie != s->rx_cookie) {

            if (!s->header_mismatch) {