diff options
Diffstat (limited to 'sys/netipsec/key.c')
| -rw-r--r-- | sys/netipsec/key.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index bd25513..cb0284c 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -3209,7 +3209,12 @@ key_mature(struct secasvar *sav) switch (sav->sah->saidx.proto) { case IPPROTO_ESP: case IPPROTO_AH: - if (ntohl(sav->spi) >= 0 && ntohl(sav->spi) <= 255) { + /* + * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values + * 1-255 reserved by IANA for future use, + * 0 for implementation specific, local use. + */ + if (ntohl(sav->spi) <= 255) { ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n", __func__, (u_int32_t)ntohl(sav->spi))); return EINVAL; |
