aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorMasahide NAKAMURA <nakam@linux-ipv6.org>2006-08-23 22:12:01 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-09-22 18:06:44 -0400
commite53820de0f81da1429048634cadc6ef5f50c2f8b (patch)
tree7a63689f564c0719a0d4fea2cc5d3b84ea00fbbd /include
parent9afaca057980c02771f4657c455cc7592fcd7373 (diff)
[XFRM] IPV6: Restrict bundle reusing
For outbound transformation, bundle is checked whether it is suitable for current flow to be reused or not. In such IPv6 case as below, transformation may apply incorrect bundle for the flow instead of creating another bundle: - The policy selector has destination prefix length < 128 (Two or more addresses can be matched it) - Its bundle holds dst entry of default route whose prefix length < 128 (Previous traffic was used such route as next hop) - The policy and the bundle were used a transport mode state and this time flow address is not matched the bundled state. This issue is found by Mobile IPv6 usage to protect mobility signaling by IPsec, but it is not a Mobile IPv6 specific. This patch adds strict check to xfrm_bundle_ok() for each state mode and address when prefix length is less than 128. Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
-rw-r--r--include/net/xfrm.h19
1 files changed, 18 insertions, 1 deletions
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 248874ecf8df..7f1630630dcf 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -869,6 +869,23 @@ xfrm_state_addr_check(struct xfrm_state *x,
869 return 0; 869 return 0;
870} 870}
871 871
872static __inline__ int
873xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl,
874 unsigned short family)
875{
876 switch (family) {
877 case AF_INET:
878 return __xfrm4_state_addr_check(x,
879 (xfrm_address_t *)&fl->fl4_dst,
880 (xfrm_address_t *)&fl->fl4_src);
881 case AF_INET6:
882 return __xfrm6_state_addr_check(x,
883 (xfrm_address_t *)&fl->fl6_dst,
884 (xfrm_address_t *)&fl->fl6_src);
885 }
886 return 0;
887}
888
872static inline int xfrm_state_kern(struct xfrm_state *x) 889static inline int xfrm_state_kern(struct xfrm_state *x)
873{ 890{
874 return atomic_read(&x->tunnel_users); 891 return atomic_read(&x->tunnel_users);
@@ -1014,7 +1031,7 @@ extern void xfrm_policy_flush(void);
1014extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 1031extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1015extern int xfrm_flush_bundles(void); 1032extern int xfrm_flush_bundles(void);
1016extern void xfrm_flush_all_bundles(void); 1033extern void xfrm_flush_all_bundles(void);
1017extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family); 1034extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family, int strict);
1018extern void xfrm_init_pmtu(struct dst_entry *dst); 1035extern void xfrm_init_pmtu(struct dst_entry *dst);
1019 1036
1020extern wait_queue_head_t km_waitq; 1037extern wait_queue_head_t km_waitq;