xfrm: wrong hash value for temporary SA
When kernel inserts a temporary SA for IKE, it uses the wrong hash value for dst list. Two hash values were calcultated before: one with source address and one with a wildcard source address. Bug hinted by Junwei Zhang <junwei.zhang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
committed by
David S. Miller
parent
8f955d7f04
commit
6a783c9067
@@ -794,7 +794,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
|
|||||||
{
|
{
|
||||||
static xfrm_address_t saddr_wildcard = { };
|
static xfrm_address_t saddr_wildcard = { };
|
||||||
struct net *net = xp_net(pol);
|
struct net *net = xp_net(pol);
|
||||||
unsigned int h;
|
unsigned int h, h_wildcard;
|
||||||
struct hlist_node *entry;
|
struct hlist_node *entry;
|
||||||
struct xfrm_state *x, *x0, *to_put;
|
struct xfrm_state *x, *x0, *to_put;
|
||||||
int acquire_in_progress = 0;
|
int acquire_in_progress = 0;
|
||||||
@@ -819,8 +819,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
|
|||||||
if (best)
|
if (best)
|
||||||
goto found;
|
goto found;
|
||||||
|
|
||||||
h = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
|
h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
|
||||||
hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
|
hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
|
||||||
if (x->props.family == family &&
|
if (x->props.family == family &&
|
||||||
x->props.reqid == tmpl->reqid &&
|
x->props.reqid == tmpl->reqid &&
|
||||||
!(x->props.flags & XFRM_STATE_WILDRECV) &&
|
!(x->props.flags & XFRM_STATE_WILDRECV) &&
|
||||||
|
Reference in New Issue
Block a user