summaryrefslogtreecommitdiff
path: root/net/ipv6
diff options
context:
space:
mode:
authorSabrina Dubroca <sd@queasysnail.net>2020-07-27 16:03:47 +0200
committerSteffen Klassert <steffen.klassert@secunet.com>2020-07-28 07:57:23 +0200
commitd5dba1376e2bafec0f4408dc65706c5908964083 (patch)
tree40cdcec327da46d657fe6953886ddab61ff373c6 /net/ipv6
parent37bd22420f856fcd976989f1d4f1f7ad28e1fcac (diff)
xfrm: esp6: fix the location of the transport header with encapsulation
commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset computation") changed esp6_input_done2 to correctly find the size of the IPv6 header that precedes the TCP/UDP encapsulation header, but didn't adjust the final call to skb_set_transport_header, which I assumed was correct in using skb_network_header_len. Xiumei Mu reported that when we create xfrm states that include port numbers in the selector, traffic from the user sockets is dropped. It turns out that we get a state mismatch in __xfrm_policy_check, because we end up trying to compare the encapsulation header's ports with the selector that's based on user traffic ports. Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP") Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/esp6.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 55ae70be91b3..52c2f063529f 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -815,6 +815,7 @@ int esp6_input_done2(struct sk_buff *skb, int err)
offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
uh = (void *)(skb->data + offset);
th = (void *)(skb->data + offset);
+ hdr_len += offset;
switch (x->encap->encap_type) {
case TCP_ENCAP_ESPINTCP: