iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[XFRM]: beet: fix beet mode decapsulation

Browse Source 
Beet mode decapsulation fails to properly set up the skb pointers, which
only works by accident in combination with CONFIG_NETFILTER, since in that
case the skb is fixed up in xfrm4_input before passing it to the netfilter
hooks.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2007-04-05 15:59:41 -07:00 committed by David S. Miller
parent 04fef9893a
commit d4b1e84062
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/ipv4/xfrm4_mode_beet.c
View File

@ -83,24 +83,24 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
if (!pskb_may_pull(skb, sizeof(*ph))) if (!pskb_may_pull(skb, sizeof(*ph)))
goto out; goto out;
phlen = ph->hdrlen * 8; phlen = sizeof(*ph) + ph->padlen;
optlen = phlen - ph->padlen - sizeof(*ph); optlen = ph->hdrlen * 8 - phlen;
if (optlen < 0 || optlen & 3 || optlen > 250) if (optlen < 0 || optlen & 3 || optlen > 250)
goto out; goto out;
if (!pskb_may_pull(skb, phlen)) if (!pskb_may_pull(skb, phlen + optlen))
goto out; goto out;
ph_nexthdr = ph->nexthdr; ph_nexthdr = ph->nexthdr;
} }
skb_push(skb, sizeof(*iph) - phlen + optlen); skb->nh.raw = skb->data + (phlen - sizeof(*iph));
memmove(skb->data, skb->nh.raw, sizeof(*iph)); memmove(skb->nh.raw, iph, sizeof(*iph));
skb->nh.raw = skb->data; skb->h.raw = skb->data + (phlen + optlen);
iph = skb->nh.iph; iph = skb->nh.iph;
iph->ihl = (sizeof(*iph) + optlen) / 4; iph->ihl = (sizeof(*iph) + optlen) / 4;
iph->tot_len = htons(skb->len); iph->tot_len = htons(skb->len + iph->ihl * 4);
iph->daddr = x->sel.daddr.a4; iph->daddr = x->sel.daddr.a4;
iph->saddr = x->sel.saddr.a4; iph->saddr = x->sel.saddr.a4;
if (ph_nexthdr) if (ph_nexthdr)