kernel/git/stable/linux.git/net/ipv4/esp4.c, branch linux-3.16.y

xfrm: Return error on unknown encap_type in init_state

2018-03-03T15:52:15+00:00

commit bcfd09f7837f5240c30fd2f52ee7293516641faa upstream. Currently esp will happily create an xfrm state with an unknown encap type for IPv4, without setting the necessary state parameters. This patch fixes it by returning -EINVAL. There is a similar problem in IPv6 where if the mode is unknown we will skip initialisation while returning zero. However, this is harmless as the mode has already been checked further up the stack. This patch removes this anomaly by aligning the IPv6 behaviour with IPv4 and treating unknown modes (which cannot actually happen) as transport mode. Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP") Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert Signed-off-by: Ben Hutchings

esp4: Use the IPsec protocol multiplexer API

2014-02-25T06:04:17+00:00

Switch esp4 to use the new IPsec protocol multiplexer. Signed-off-by: Steffen Klassert

net: esp{4,6}: get rid of struct esp_data

2013-10-29T05:39:42+00:00

struct esp_data consists of a single pointer, vanishing the need for it to be a structure. Fold the pointer into 'data' direcly, removing one level of pointer indirection. Signed-off-by: Mathias Krause Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Signed-off-by: Steffen Klassert

net: esp{4,6}: remove padlen from struct esp_data

2013-10-29T05:39:42+00:00

The padlen member of struct esp_data is always zero. Get rid of it. Signed-off-by: Mathias Krause Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Signed-off-by: Steffen Klassert

net: esp{4,6}: fix potential MTU calculation overflows

2013-08-05T19:26:50+00:00

Commit 91657eafb ("xfrm: take net hdr len into account for esp payload size calculation") introduced a possible interger overflow in esp{4,6}_get_mtu() handlers in case of x->props.mode equals XFRM_MODE_TUNNEL. Thus, the following expression will overflow unsigned int net_adj; ... net_adj = 0; ... return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) - net_adj) & ~(align - 1)) + (net_adj - 2); where (net_adj - 2) would be evaluated as + (0 - 2) in an unsigned context. Fix it by simply removing brackets as those operations here do not need to have special precedence. Signed-off-by: Daniel Borkmann Cc: Benjamin Poirier Cc: Steffen Klassert Acked-by: Benjamin Poirier Signed-off-by: David S. Miller

ipv4: properly refresh rtable entries on pmtu/redirect events

2013-06-03T07:07:42+00:00

This reverts commit 05ab86c5 (xfrm4: Invalidate all ipv4 routes on IPsec pmtu events). Flushing all cached entries is not needed. Instead, invalidate only the related next hop dsts to recheck for the added next hop exception where needed. This also fixes a subtle race due to bumping generation id's before updating the pmtu. Cc: Steffen Klassert Signed-off-by: Timo Teräs Signed-off-by: David S. Miller

esp4: fix error return code in esp_output()

2013-04-15T18:05:34+00:00

Fix to return a negative error code from the error handling case instead of 0, as returned elsewhere in this function. Signed-off-by: Wei Yongjun Acked-by: Steffen Klassert Signed-off-by: David S. Miller

xfrm4: Invalidate all ipv4 routes on IPsec pmtu events

2013-01-21T11:43:54+00:00

On IPsec pmtu events we can't access the transport headers of the original packet, so we can't find the socket that sent the packet. The only chance to notify the socket about the pmtu change is to force a relookup for all routes. This patch implenents this for the IPsec protocols. Signed-off-by: Steffen Klassert

ah4/esp4: set transport header correctly for IPsec tunnel mode.

2013-01-08T11:41:30+00:00

IPsec tunnel does not set ECN field to CE in inner header when the ECN field in the outer header is CE, and the ECN field in the inner header is ECT(0) or ECT(1). The cause is ipip_hdr() does not return the correct address of inner header since skb->transport-header is not the inner header after esp_input_done2(), or ah_input(). Signed-off-by: Li RongQing Signed-off-by: Steffen Klassert

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-12T04:27:49+00:00

Signed-off-by: David S. Miller