* Subject: [PATCH net] drivers: net: ixgbe: Fix *_ipsec_offload_ok():, Use ip_hdr family
@ 2020-10-26 14:44 Christian Langrock
2020-10-26 15:33 ` Jesse Brandeburg
0 siblings, 1 reply; 2+ messages in thread
From: Christian Langrock @ 2020-10-26 14:44 UTC (permalink / raw)
To: davem, netdev, jesse.brandeburg, anthony.l.nguyen
[-- Attachment #1.1: Type: text/plain, Size: 2576 bytes --]
Xfrm_dev_offload_ok() is called with the unencrypted SKB. So in case of
interfamily ipsec traffic (IPv4-in-IPv6 and IPv6 in IPv4) the check
assumes the wrong family of the skb (IP family of the state).
With this patch the ip header of the SKB is used to determine the
family.
Signed-off-by: Christian Langrock <christian.langrock@secunet.com>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +-
drivers/net/ethernet/intel/ixgbevf/ipsec.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index eca73526ac86..3601dd293463 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -813,7 +813,7 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs)
**/
static bool ixgbe_ipsec_offload_ok(struct sk_buff *skb, struct
xfrm_state *xs)
{
- if (xs->props.family == AF_INET) {
+ if (ip_hdr(skb)->version == 4) {
/* Offload with IPv4 options is not supported yet */
if (ip_hdr(skb)->ihl != 5)
return false;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
index 5170dd9d8705..b1d72d5d1744 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
@@ -418,7 +418,7 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs)
**/
static bool ixgbevf_ipsec_offload_ok(struct sk_buff *skb, struct
xfrm_state *xs)
{
- if (xs->props.family == AF_INET) {
+ if (ip_hdr(skb)->version == 4) {
/* Offload with IPv4 options is not supported yet */
if (ip_hdr(skb)->ihl != 5)
return false;
--
2.29.1.1.g2e673356ae
--
Dipl.-Inf.(FH) Christian Langrock
Senior Consultant
Network & Client Security
Division Public Authorities
secunet Security Networks AG
Phone: +49 201 5454-3833
E-Mail: christian.langrock@secunet.com
Ammonstraße 74
01067 Dresden, Germany
www.secunet.com
______________________________________________________________________
Registered at: Kurfuerstenstrasse 58, 45138 Essen, Germany
Amtsgericht Essen HRB 13615
Management Board: Dr Rainer Baumgart (CEO), Thomas Pleines
Chairman of Supervisory Board: Ralf Wintergerst
______________________________________________________________________
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: Subject: [PATCH net] drivers: net: ixgbe: Fix *_ipsec_offload_ok():, Use ip_hdr family
2020-10-26 14:44 Subject: [PATCH net] drivers: net: ixgbe: Fix *_ipsec_offload_ok():, Use ip_hdr family Christian Langrock
@ 2020-10-26 15:33 ` Jesse Brandeburg
0 siblings, 0 replies; 2+ messages in thread
From: Jesse Brandeburg @ 2020-10-26 15:33 UTC (permalink / raw)
To: Christian Langrock; +Cc: davem, netdev, anthony.l.nguyen
Christian Langrock wrote:
Please fix your subject, remove the word 'Subject: '
> Xfrm_dev_offload_ok() is called with the unencrypted SKB. So in case of
> interfamily ipsec traffic (IPv4-in-IPv6 and IPv6 in IPv4) the check
> assumes the wrong family of the skb (IP family of the state).
> With this patch the ip header of the SKB is used to determine the
> family.
>
missing "Fixes: " line? It's useful here because I think this looks
like a good candidate for stable bug fix.
> Signed-off-by: Christian Langrock <christian.langrock@secunet.com>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +-
> drivers/net/ethernet/intel/ixgbevf/ipsec.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
The patch looks ok otherwise, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-10-26 15:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-26 14:44 Subject: [PATCH net] drivers: net: ixgbe: Fix *_ipsec_offload_ok():, Use ip_hdr family Christian Langrock
2020-10-26 15:33 ` Jesse Brandeburg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).