kern/60743: l2tp(4): missing and broken access/sanity checks

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60743
>Category:       kern
>Synopsis:       l2tp(4): missing and broken access/sanity checks
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 18 21:05:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The NetL2TP Foundsomebugs, Inc.
>Environment:
>Description:

	1. l2tp_ioctl is missing kauth checks for all
	   interface-specific privileged ioctl commands like
	   SIOCSL2TPSESSION.  Generic ioctls with have kauth checks in
	   doifioctl, but interface-specific ones are the interface's
	   responsibility:

   3498 	switch (cmd) {
   3499 	case SIOCALIFADDR:
...
   3525 	case SIOCSLINKSTR:
   3526 		if (l != NULL) {
   3527 			error = kauth_authorize_network(l->l_cred,
   3528 			    KAUTH_NETWORK_INTERFACE,
   3529 			    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp,
   3530 			    KAUTH_ARG(cmd), NULL);
   3531 			if (error != 0)
   3532 				goto out;
   3533 		}
   3534 	}

	   https://nxr.NetBSD.org/xref/src/sys/net/if.c?r=1.538#3498

	2. Cookie length validation has && where it needs || to verify
	   that the cookie length is either 4 or 8:

   1284 	if (my_cookie_len != 4 && my_cookie_len != 8
   1285 	    && peer_cookie_len != 4 && peer_cookie_len != 8)
   1286 		return EINVAL;

	   https://nxr.netbsd.org/xref/src/sys/net/if_l2tp.c?r=1.49#1284

>How-To-Repeat:
	int s;
	struct ifreq ifr;
	struct l2tp_req l2tpr;

	s = socket(AF_INET, SOCK_DGRAM, 0);
	if (s == -1)
		err(1, "socket");

	memset(&ifr, 0, sizeof(ifr));
	ifr.ifr_data = &l2tpr;
	strncpy(ifr.ifr_name, "l2tp0", sizeof(ifr.ifr_name));

	memset(&l2tpr, 0, sizeof(l2tpr));
	l2tpr.my_cookie = 1;
	l2tpr.peer_cookie = 1;
	l2tpr.my_cookie_len = 4;
	l2tpr.peer_cookie_len = 12345;
	if (ioctl(s, SIOCSL2TPCOOKIE, &ifr) == -1)
		err(1, "ioctl(SIOCSL2TPCOOKIE)");

>Fix:

	1. add kauth check
	2. && ---> ||