Commit af268182 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[ICMP]: Ensure that ICMP relookup maintains status quo 



The ICMP relookup path is only meant to modify behaviour when
appropriate IPsec policies are in place and marked as requiring
relookups.  It is certainly not meant to modify behaviour when
IPsec policies don't exist at all.

However, due to an oversight on the error paths existing behaviour
may in fact change should one of the relookup steps fail.

This patch corrects this by redirecting all errors on relookup
failures to the previous code path.  That is, if the initial
xfrm_lookup let the packet pass, we will stand by that decision
should the relookup fail due to an error.

This should be safe from a security point-of-view because compliant
systems must install a default deny policy so the packet would'nt
have passed in that case.

Many thanks to Julian Anastasov for pointing out this error.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9597362d

net/ipv4/icmp.c

+13 −11
Original line number Diff line number Diff line
@@ -591,7 +591,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) 
		}



		if (xfrm_decode_session_reverse(skb_in, &fl, AF_INET))

			goto ende;

			goto relookup_failed;



		if (inet_addr_type(net, fl.fl4_src) == RTN_LOCAL)

			err = __ip_route_output_key(net, &rt2, &fl);
@@ -601,7 +601,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) 


			fl2.fl4_dst = fl.fl4_src;

			if (ip_route_output_key(net, &rt2, &fl2))

				goto ende;

				goto relookup_failed;



			/* Ugh! */

			odst = skb_in->dst;
@@ -614,21 +614,23 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) 
		}



		if (err)

			goto ende;

			goto relookup_failed;



		err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL,

				  XFRM_LOOKUP_ICMP);

		if (err == -ENOENT) {

			if (!rt)

				goto out_unlock;

			goto route_done;

		}



		switch (err) {

		case 0:

			dst_release(&rt->u.dst);

			rt = rt2;



		if (err)

			break;

		case -EPERM:

			goto ende;

		default:

relookup_failed:

			if (!rt)

				goto out_unlock;

			break;

		}

	}



route_done:

net/ipv6/icmp.c

+12 −10
Original line number Diff line number Diff line
@@ -436,23 +436,25 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info, 
	}



	if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))

		goto out_dst_release;

		goto relookup_failed;



	if (ip6_dst_lookup(sk, &dst2, &fl))

		goto out_dst_release;

		goto relookup_failed;



	err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP);

	if (err == -ENOENT) {

		if (!dst)

			goto out;

		goto route_done;

	}



	switch (err) {

	case 0:

		dst_release(dst);

		dst = dst2;



	if (err)

		break;

	case -EPERM:

		goto out_dst_release;

	default:

relookup_failed:

		if (!dst)

			goto out;

		break;

	}



route_done:

	if (ipv6_addr_is_multicast(&fl.fl6_dst))

CRA Git | Maintained and supported by SUSTech CRA and CCSE