Skip to content

Commit

Permalink
vti4: Check the tunnel endpoints of the xfrm state and the vti interface
Browse files Browse the repository at this point in the history
The tunnel endpoints of the xfrm_state we got from the xfrm_lookup
must match the tunnel endpoints of the vti interface. This patch
ensures this matching.

Signed-off-by: Steffen Klassert <[email protected]>
  • Loading branch information
klassert committed Feb 25, 2014
1 parent 78a010c commit 6e2de80
Showing 1 changed file with 24 additions and 5 deletions.
29 changes: 24 additions & 5 deletions net/ipv4/ip_vti.c
Original file line number Diff line number Diff line change
Expand Up @@ -123,10 +123,32 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
return 0;
}

static bool vti_state_check(const struct xfrm_state *x, __be32 dst, __be32 src)
{
xfrm_address_t *daddr = (xfrm_address_t *)&dst;
xfrm_address_t *saddr = (xfrm_address_t *)&src;

/* if there is no transform then this tunnel is not functional.
* Or if the xfrm is not mode tunnel.
*/
if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
x->props.family != AF_INET)
return false;

if (!dst)
return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET);

if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET))
return false;

return true;
}

static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
struct flowi *fl)
{
struct ip_tunnel *tunnel = netdev_priv(dev);
struct ip_tunnel_parm *parms = &tunnel->parms;
struct dst_entry *dst = skb_dst(skb);
struct net_device *tdev; /* Device to other host */
int err;
Expand All @@ -143,15 +165,12 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
goto tx_error_icmp;
}

/* if there is no transform then this tunnel is not functional.
* Or if the xfrm is not mode tunnel.
*/
if (!dst->xfrm ||
dst->xfrm->props.mode != XFRM_MODE_TUNNEL) {
if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
dev->stats.tx_carrier_errors++;
dst_release(dst);
goto tx_error_icmp;
}

tdev = dst->dev;

if (tdev == dev) {
Expand Down

0 comments on commit 6e2de80

Please sign in to comment.