732c8bd590
The IPv6 BEET output function is incorrectly including the inner header in the payload to be protected. This causes a crash as the packet doesn't actually have that many bytes for a second header. The IPv4 BEET output on the other hand is broken when it comes to handling an inner IPv6 header since it always assumes an inner IPv4 header. This patch fixes both by making sure that neither BEET output function touches the inner header at all. All access is now done through the protocol-independent cb structure. Two new attributes are added to make this work, the IP header length and the IPv4 option length. They're filled in by the inner mode's output function. Thanks to Joakim Koskela for finding this problem. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
114 lines
2.9 KiB
C
114 lines
2.9 KiB
C
/*
|
|
* xfrm6_mode_beet.c - BEET mode encapsulation for IPv6.
|
|
*
|
|
* Copyright (c) 2006 Diego Beltrami <diego.beltrami@gmail.com>
|
|
* Miika Komu <miika@iki.fi>
|
|
* Herbert Xu <herbert@gondor.apana.org.au>
|
|
* Abhinav Pathak <abhinav.pathak@hiit.fi>
|
|
* Jeff Ahrenholz <ahrenholz@gmail.com>
|
|
*/
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/stringify.h>
|
|
#include <net/dsfield.h>
|
|
#include <net/dst.h>
|
|
#include <net/inet_ecn.h>
|
|
#include <net/ipv6.h>
|
|
#include <net/xfrm.h>
|
|
|
|
static void xfrm6_beet_make_header(struct sk_buff *skb)
|
|
{
|
|
struct ipv6hdr *iph = ipv6_hdr(skb);
|
|
|
|
iph->version = 6;
|
|
|
|
memcpy(iph->flow_lbl, XFRM_MODE_SKB_CB(skb)->flow_lbl,
|
|
sizeof(iph->flow_lbl));
|
|
iph->nexthdr = XFRM_MODE_SKB_CB(skb)->protocol;
|
|
|
|
ipv6_change_dsfield(iph, 0, XFRM_MODE_SKB_CB(skb)->tos);
|
|
iph->hop_limit = XFRM_MODE_SKB_CB(skb)->ttl;
|
|
}
|
|
|
|
/* Add encapsulation header.
|
|
*
|
|
* The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.
|
|
*/
|
|
static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
{
|
|
struct ipv6hdr *top_iph;
|
|
|
|
skb_set_network_header(skb, -x->props.header_len);
|
|
skb->mac_header = skb->network_header +
|
|
offsetof(struct ipv6hdr, nexthdr);
|
|
skb->transport_header = skb->network_header + sizeof(*top_iph);
|
|
__skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl);
|
|
|
|
xfrm6_beet_make_header(skb);
|
|
|
|
top_iph = ipv6_hdr(skb);
|
|
|
|
ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
|
|
ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
|
|
return 0;
|
|
}
|
|
|
|
static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
|
|
{
|
|
struct ipv6hdr *ip6h;
|
|
const unsigned char *old_mac;
|
|
int size = sizeof(struct ipv6hdr);
|
|
int err;
|
|
|
|
err = skb_cow_head(skb, size + skb->mac_len);
|
|
if (err)
|
|
goto out;
|
|
|
|
__skb_push(skb, size);
|
|
skb_reset_network_header(skb);
|
|
|
|
old_mac = skb_mac_header(skb);
|
|
skb_set_mac_header(skb, -skb->mac_len);
|
|
memmove(skb_mac_header(skb), old_mac, skb->mac_len);
|
|
|
|
xfrm6_beet_make_header(skb);
|
|
|
|
ip6h = ipv6_hdr(skb);
|
|
ip6h->payload_len = htons(skb->len - size);
|
|
ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *) &x->sel.daddr.a6);
|
|
ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *) &x->sel.saddr.a6);
|
|
err = 0;
|
|
out:
|
|
return err;
|
|
}
|
|
|
|
static struct xfrm_mode xfrm6_beet_mode = {
|
|
.input2 = xfrm6_beet_input,
|
|
.input = xfrm_prepare_input,
|
|
.output2 = xfrm6_beet_output,
|
|
.output = xfrm6_prepare_output,
|
|
.owner = THIS_MODULE,
|
|
.encap = XFRM_MODE_BEET,
|
|
.flags = XFRM_MODE_FLAG_TUNNEL,
|
|
};
|
|
|
|
static int __init xfrm6_beet_init(void)
|
|
{
|
|
return xfrm_register_mode(&xfrm6_beet_mode, AF_INET6);
|
|
}
|
|
|
|
static void __exit xfrm6_beet_exit(void)
|
|
{
|
|
int err;
|
|
|
|
err = xfrm_unregister_mode(&xfrm6_beet_mode, AF_INET6);
|
|
BUG_ON(err);
|
|
}
|
|
|
|
module_init(xfrm6_beet_init);
|
|
module_exit(xfrm6_beet_exit);
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_ALIAS_XFRM_MODE(AF_INET6, XFRM_MODE_BEET);
|