xfrm: Allow different selector family in temporary state

The family parameter xfrm_state_find is used to find a state matching a
certain policy. This value is set to the template's family
(encap_family) right before xfrm_state_find is called.
The family parameter is however also used to construct a temporary state
in xfrm_state_find itself which is wrong for inter-family scenarios
because it produces a selector for the wrong family. Since this selector
is included in the xfrm_user_acquire structure, user space programs
misinterpret IPv6 addresses as IPv4 and vice versa.
This patch splits up the original init_tempsel function into a part that
initializes the selector respectively the props and id of the temporary
state, to allow for differing ip address families whithin the state.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 19 insertions, 14 deletions

diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 1ef1366a0a03..47947624eccc 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -21,21 +21,25 @@ static int xfrm4_init_flags(struct xfrm_state *x)
 }
 
 static void
-__xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                     struct xfrm_tmpl *tmpl,
-                     xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm4_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
+{
+        sel->daddr.a4 = fl->fl4_dst;
+        sel->saddr.a4 = fl->fl4_src;
+        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport_mask = htons(0xffff);
+        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport_mask = htons(0xffff);
+        sel->family = AF_INET;
+        sel->prefixlen_d = 32;
+        sel->prefixlen_s = 32;
+        sel->proto = fl->proto;
+        sel->ifindex = fl->oif;
+}
+
+static void
+xfrm4_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+                   xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        x->sel.daddr.a4 = fl->fl4_dst;
-        x->sel.saddr.a4 = fl->fl4_src;
-        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = htons(0xffff);
-        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = htons(0xffff);
-        x->sel.family = AF_INET;
-        x->sel.prefixlen_d = 32;
-        x->sel.prefixlen_s = 32;
-        x->sel.proto = fl->proto;
-        x->sel.ifindex = fl->oif;
         x->id = tmpl->id;
         if (x->id.daddr.a4 == 0)
                 x->id.daddr.a4 = daddr->a4;
@@ -70,6 +74,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .owner                  = THIS_MODULE,
         .init_flags             = xfrm4_init_flags,
         .init_tempsel           = __xfrm4_init_tempsel,
+        .init_temprop           = xfrm4_init_temprop,
         .output                 = xfrm4_output,
         .extract_input          = xfrm4_extract_input,
         .extract_output         = xfrm4_extract_output,