iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vti6: Check the tunnel endpoints of the xfrm state and the vti interface

Browse Source 
The tunnel endpoints of the xfrm_state we got from the xfrm_lookup
must match the tunnel endpoints of the vti interface. This patch
ensures this matching.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Steffen Klassert 2014-03-14 07:28:09 +01:00
parent 22e1b23daf
commit 26be8e2db4
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
net/ipv6/ip6_vti.c
View File

@ -376,6 +376,29 @@ vti6_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
}
static bool vti6_state_check(const struct xfrm_state *x,
const struct in6_addr *dst,
const struct in6_addr *src)
{
xfrm_address_t *daddr = (xfrm_address_t *)dst;
xfrm_address_t *saddr = (xfrm_address_t *)src;
/* if there is no transform then this tunnel is not functional.
* Or if the xfrm is not mode tunnel.
*/
if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
x->props.family != AF_INET6)
return false;
if (ipv6_addr_any(dst))
return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET6);
if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET6))
return false;
return true;
}
/**
* vti6_xmit - send a packet
* @skb: the outgoing socket buffer
@ -402,7 +425,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
goto tx_err_link_failure;
}
if (!dst->xfrm || dst->xfrm->props.mode != XFRM_MODE_TUNNEL)
if (!vti6_state_check(dst->xfrm, &t->parms.raddr, &t->parms.laddr))
goto tx_err_link_failure;
tdev = dst->dev;