Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec (f6063850) · Commits · 戴 / test

Steffen Klassert says: ==================== 1) We used the wrong netlink attribute to verify the lenght of the replay window on async events. Fix this by using the right netlink attribute. 2) Policy lookups can not match the output interface on forwarding. Add the needed informations to the flow informations. 3) We update the pmtu when we receive a ICMPV6_DEST_UNREACH message on IPsec with ipv6. This is wrong and leads to strange fragmented packets, only ICMPV6_PKT_TOOBIG messages should update the pmtu. Fix this by removing the ICMPV6_DEST_UNREACH check from the IPsec protocol error handlers. 4) The legacy IPsec anti replay mechanism supports anti replay windows up to 32 packets. If a user requests for a bigger anti replay window, we use 32 packets but pretend that we use the requested window size. Fix from Fan Du. 5) If asynchronous events are enabled and replay_maxdiff is set to zero, we generate an async event for every received packet instead of checking whether a timeout occurred. Fix from Thomas Egerer. 6) Policies need a refcount when the state resolution timer is armed. Otherwise the timer can fire after the policy is deleted. 7) We might dreference a NULL pointer if the hold_queue is empty, add a check to avoid this. ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/xfrm4_policy.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -107,6 +107,7 @@ _decode_session4(struct sk_buff skb, struct flowi fl, int reverse)

		memset(fl4, 0, sizeof(struct flowi4));
		fl4->flowi4_mark = skb->mark;
		fl4->flowi4_oif = skb_dst(skb)->dev->ifindex;

		if (!ip_is_fragment(iph)) {
		switch (iph->protocol) {

net/ipv6/ah6.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -618,8 +618,7 @@ static void ah6_err(struct sk_buff skb, struct inet6_skb_parm opt,
		struct ip_auth_hdr ah = (struct ip_auth_hdr)(skb->data+offset);
		struct xfrm_state *x;

		if (type != ICMPV6_DEST_UNREACH &&
		type != ICMPV6_PKT_TOOBIG &&
		if (type != ICMPV6_PKT_TOOBIG &&
		type != NDISC_REDIRECT)
		return;

net/ipv6/esp6.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -436,8 +436,7 @@ static void esp6_err(struct sk_buff skb, struct inet6_skb_parm opt,
		struct ip_esp_hdr esph = (struct ip_esp_hdr )(skb->data + offset);
		struct xfrm_state *x;

		if (type != ICMPV6_DEST_UNREACH &&
		type != ICMPV6_PKT_TOOBIG &&
		if (type != ICMPV6_PKT_TOOBIG &&
		type != NDISC_REDIRECT)
		return;

net/ipv6/ipcomp6.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -64,8 +64,7 @@ static void ipcomp6_err(struct sk_buff skb, struct inet6_skb_parm opt,
		(struct ip_comp_hdr *)(skb->data + offset);
		struct xfrm_state *x;

		if (type != ICMPV6_DEST_UNREACH &&
		type != ICMPV6_PKT_TOOBIG &&
		if (type != ICMPV6_PKT_TOOBIG &&
		type != NDISC_REDIRECT)
		return;

net/ipv6/xfrm6_policy.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -138,6 +138,7 @@ _decode_session6(struct sk_buff skb, struct flowi fl, int reverse)

		memset(fl6, 0, sizeof(struct flowi6));
		fl6->flowi6_mark = skb->mark;
		fl6->flowi6_oif = skb_dst(skb)->dev->ifindex;

		fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
		fl6->saddr = reverse ? hdr->daddr : hdr->saddr;

Admin message