diff options
| author | Sabrina Dubroca <sd@queasysnail.net> | 2020-07-27 16:03:47 +0200 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2020-07-28 07:57:23 +0200 |
| commit | d5dba1376e2bafec0f4408dc65706c5908964083 (patch) | |
| tree | 40cdcec327da46d657fe6953886ddab61ff373c6 /security | |
| parent | 37bd22420f856fcd976989f1d4f1f7ad28e1fcac (diff) | |
xfrm: esp6: fix the location of the transport header with encapsulation
commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset
computation") changed esp6_input_done2 to correctly find the size of
the IPv6 header that precedes the TCP/UDP encapsulation header, but
didn't adjust the final call to skb_set_transport_header, which I
assumed was correct in using skb_network_header_len.
Xiumei Mu reported that when we create xfrm states that include port
numbers in the selector, traffic from the user sockets is dropped. It
turns out that we get a state mismatch in __xfrm_policy_check, because
we end up trying to compare the encapsulation header's ports with the
selector that's based on user traffic ports.
Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP")
Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions