| Message ID | 2159be20972bd53beefeb0b8ad31adac2792105d.1595858511.git.sd@queasysnail.net |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | David Miller |
| Headers | show |
| Series | [ipsec] xfrm: esp6: fix the location of the transport header with encapsulation | expand |
On Mon, Jul 27, 2020 at 04:03:47PM +0200, Sabrina Dubroca wrote: > commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset > computation") changed esp6_input_done2 to correctly find the size of > the IPv6 header that precedes the TCP/UDP encapsulation header, but > didn't adjust the final call to skb_set_transport_header, which I > assumed was correct in using skb_network_header_len. > > Xiumei Mu reported that when we create xfrm states that include port > numbers in the selector, traffic from the user sockets is dropped. It > turns out that we get a state mismatch in __xfrm_policy_check, because > we end up trying to compare the encapsulation header's ports with the > selector that's based on user traffic ports. > > Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP") > Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp") > Reported-by: Xiumei Mu <xmu@redhat.com> > Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Applied, thanks a lot Sabrina!
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index 55ae70be91b3..52c2f063529f 100644 --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c @@ -815,6 +815,7 @@ int esp6_input_done2(struct sk_buff *skb, int err) offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); uh = (void *)(skb->data + offset); th = (void *)(skb->data + offset); + hdr_len += offset; switch (x->encap->encap_type) { case TCP_ENCAP_ESPINTCP:
commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset computation") changed esp6_input_done2 to correctly find the size of the IPv6 header that precedes the TCP/UDP encapsulation header, but didn't adjust the final call to skb_set_transport_header, which I assumed was correct in using skb_network_header_len. Xiumei Mu reported that when we create xfrm states that include port numbers in the selector, traffic from the user sockets is dropped. It turns out that we get a state mismatch in __xfrm_policy_check, because we end up trying to compare the encapsulation header's ports with the selector that's based on user traffic ports. Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP") Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> --- net/ipv6/esp6.c | 1 + 1 file changed, 1 insertion(+)