Commit 0c8729c9 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 



Steffen Klassert says:

====================
1) The transport header did not point to the right place after
   esp/ah processing on tunnel mode in the receive path. As a
   result, the ECN field of the inner header was not set correctly,
   fixes from Li RongQing.

2) We did a null check too late in one of the xfrm_replay advance
   functions. This can lead to a division by zero, fix from
   Nickolai Zeldovich.

3) The size calculation of the hash table missed the muiltplication
   with the actual struct size when the hash table is freed.
   We might call the wrong free function, fix from Michal Kubecek.

4) On IPsec pmtu events we can't access the transport headers of
   the original packet, so force a relookup for all routes
   to notify about the pmtu event.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents d8429506 05ab86c5

net/ipv4/ah4.c

+14 −4
Original line number Diff line number Diff line
@@ -269,6 +269,10 @@ static void ah_input_done(struct crypto_async_request *base, int err) 
	skb->network_header += ah_hlen;

	memcpy(skb_network_header(skb), work_iph, ihl);

	__skb_pull(skb, ah_hlen + ihl);



	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

		skb_set_transport_header(skb, -ihl);

out:

	kfree(AH_SKB_CB(skb)->tmp);
@@ -381,6 +385,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) 
	skb->network_header += ah_hlen;

	memcpy(skb_network_header(skb), work_iph, ihl);

	__skb_pull(skb, ah_hlen + ihl);

	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

		skb_set_transport_header(skb, -ihl);



	err = nexthdr;
@@ -413,9 +420,12 @@ static void ah4_err(struct sk_buff *skb, u32 info) 
	if (!x)

		return;



	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)

	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {

		atomic_inc(&flow_cache_genid);

		rt_genid_bump(net);



		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0);

	else

	} else

		ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0);

	xfrm_state_put(x);

}

net/ipv4/esp4.c

+9 −3
Original line number Diff line number Diff line
@@ -346,6 +346,9 @@ static int esp_input_done2(struct sk_buff *skb, int err) 


	pskb_trim(skb, skb->len - alen - padlen - 2);

	__skb_pull(skb, hlen);

	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

		skb_set_transport_header(skb, -ihl);



	err = nexthdr[1];
@@ -499,9 +502,12 @@ static void esp4_err(struct sk_buff *skb, u32 info) 
	if (!x)

		return;



	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)

	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {

		atomic_inc(&flow_cache_genid);

		rt_genid_bump(net);



		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0);

	else

	} else

		ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0);

	xfrm_state_put(x);

}

net/ipv4/ipcomp.c

+5 −2
Original line number Diff line number Diff line
@@ -47,9 +47,12 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info) 
	if (!x)

		return;



	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)

	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {

		atomic_inc(&flow_cache_genid);

		rt_genid_bump(net);



		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);

	else

	} else

		ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);

	xfrm_state_put(x);

}

net/ipv6/ah6.c

+9 −2
Original line number Diff line number Diff line
@@ -472,6 +472,9 @@ static void ah6_input_done(struct crypto_async_request *base, int err) 
	skb->network_header += ah_hlen;

	memcpy(skb_network_header(skb), work_iph, hdr_len);

	__skb_pull(skb, ah_hlen + hdr_len);

	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

		skb_set_transport_header(skb, -hdr_len);

out:

	kfree(AH_SKB_CB(skb)->tmp);
@@ -593,9 +596,13 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) 


	skb->network_header += ah_hlen;

	memcpy(skb_network_header(skb), work_iph, hdr_len);

	skb->transport_header = skb->network_header;

	__skb_pull(skb, ah_hlen + hdr_len);



	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

		skb_set_transport_header(skb, -hdr_len);



	err = nexthdr;



out_free:

net/ipv6/esp6.c

+4 −1
Original line number Diff line number Diff line
@@ -300,6 +300,9 @@ static int esp_input_done2(struct sk_buff *skb, int err) 


	pskb_trim(skb, skb->len - alen - padlen - 2);

	__skb_pull(skb, hlen);

	if (x->props.mode == XFRM_MODE_TUNNEL)

		skb_reset_transport_header(skb);

	else

		skb_set_transport_header(skb, -hdr_len);



	err = nexthdr[1];

CRA Git | Maintained and supported by SUSTech CRA and CCSE