提交 d4b1e840 编写于 作者: P Patrick McHardy 提交者: David S. Miller

[XFRM]: beet: fix beet mode decapsulation

Beet mode decapsulation fails to properly set up the skb pointers, which
only works by accident in combination with CONFIG_NETFILTER, since in that
case the skb is fixed up in xfrm4_input before passing it to the netfilter
hooks.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 04fef989
...@@ -83,24 +83,24 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb) ...@@ -83,24 +83,24 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
if (!pskb_may_pull(skb, sizeof(*ph))) if (!pskb_may_pull(skb, sizeof(*ph)))
goto out; goto out;
phlen = ph->hdrlen * 8; phlen = sizeof(*ph) + ph->padlen;
optlen = phlen - ph->padlen - sizeof(*ph); optlen = ph->hdrlen * 8 - phlen;
if (optlen < 0 || optlen & 3 || optlen > 250) if (optlen < 0 || optlen & 3 || optlen > 250)
goto out; goto out;
if (!pskb_may_pull(skb, phlen)) if (!pskb_may_pull(skb, phlen + optlen))
goto out; goto out;
ph_nexthdr = ph->nexthdr; ph_nexthdr = ph->nexthdr;
} }
skb_push(skb, sizeof(*iph) - phlen + optlen); skb->nh.raw = skb->data + (phlen - sizeof(*iph));
memmove(skb->data, skb->nh.raw, sizeof(*iph)); memmove(skb->nh.raw, iph, sizeof(*iph));
skb->nh.raw = skb->data; skb->h.raw = skb->data + (phlen + optlen);
iph = skb->nh.iph; iph = skb->nh.iph;
iph->ihl = (sizeof(*iph) + optlen) / 4; iph->ihl = (sizeof(*iph) + optlen) / 4;
iph->tot_len = htons(skb->len); iph->tot_len = htons(skb->len + iph->ihl * 4);
iph->daddr = x->sel.daddr.a4; iph->daddr = x->sel.daddr.a4;
iph->saddr = x->sel.saddr.a4; iph->saddr = x->sel.saddr.a4;
if (ph_nexthdr) if (ph_nexthdr)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册