From: Steffen Klassert <steffen.klassert@secunet.com>
To: David Miller <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
Steffen Klassert <steffen.klassert@secunet.com>,
<netdev@vger.kernel.org>
Subject: [PATCH 02/10] xfrm: esp6: fix encapsulation header offset computation
Date: Fri, 31 Jul 2020 09:17:56 +0200 [thread overview]
Message-ID: <20200731071804.29557-3-steffen.klassert@secunet.com> (raw)
In-Reply-To: <20200731071804.29557-1-steffen.klassert@secunet.com>
From: Sabrina Dubroca <sd@queasysnail.net>
In commit 0146dca70b87, I incorrectly adapted the code that computes
the location of the UDP or TCP encapsulation header from IPv4 to
IPv6. In esp6_input_done2, skb->transport_header points to the ESP
header, so by adding skb_network_header_len, uh and th will point to
the ESP header, not the encapsulation header that's in front of it.
Since the TCP header's size can change with options, we have to start
from the IPv6 header and walk past possible extensions.
Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP")
Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp")
Reported-by: Tobias Brunner <tobias@strongswan.org>
Tested-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/ipv6/esp6.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index c43592771126..55ae70be91b3 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -805,10 +805,16 @@ int esp6_input_done2(struct sk_buff *skb, int err)
if (x->encap) {
const struct ipv6hdr *ip6h = ipv6_hdr(skb);
+ int offset = skb_network_offset(skb) + sizeof(*ip6h);
struct xfrm_encap_tmpl *encap = x->encap;
- struct udphdr *uh = (void *)(skb_network_header(skb) + hdr_len);
- struct tcphdr *th = (void *)(skb_network_header(skb) + hdr_len);
- __be16 source;
+ u8 nexthdr = ip6h->nexthdr;
+ __be16 frag_off, source;
+ struct udphdr *uh;
+ struct tcphdr *th;
+
+ offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
+ uh = (void *)(skb->data + offset);
+ th = (void *)(skb->data + offset);
switch (x->encap->encap_type) {
case TCP_ENCAP_ESPINTCP:
--
2.17.1
next prev parent reply other threads:[~2020-07-31 7:18 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-31 7:17 pull request (net): ipsec 2020-07-31 Steffen Klassert
2020-07-31 7:17 ` [PATCH 01/10] xfrm: policy: match with both mark and mask on user interfaces Steffen Klassert
2020-07-31 7:17 ` Steffen Klassert [this message]
2020-07-31 7:17 ` [PATCH 03/10] espintcp: support non-blocking sends Steffen Klassert
2020-07-31 7:17 ` [PATCH 04/10] espintcp: recv() should return 0 when the peer socket is closed Steffen Klassert
2020-07-31 7:17 ` [PATCH 05/10] xfrm: policy: fix IPv6-only espintcp compilation Steffen Klassert
2020-07-31 7:18 ` [PATCH 06/10] xfrm: Fix crash when the hold queue is used Steffen Klassert
2020-07-31 7:18 ` [PATCH 07/10] af_key: pfkey_dump needs parameter validation Steffen Klassert
2020-07-31 7:18 ` [PATCH 08/10] xfrm: esp6: fix the location of the transport header with encapsulation Steffen Klassert
2020-07-31 7:18 ` [PATCH 09/10] espintcp: handle short messages instead of breaking the encap socket Steffen Klassert
2020-07-31 7:18 ` [PATCH 10/10] espintcp: count packets dropped in espintcp_rcv Steffen Klassert
2020-08-01 0:11 ` pull request (net): ipsec 2020-07-31 David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200731071804.29557-3-steffen.klassert@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).