| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20071114073425.GA11815@gondor.apana.org.au>
Date: Wed, 14 Nov 2007 15:34:25 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: [IPSEC]: Fix ip_local_out when NETFILTER is off
Hi Dave:
[IPSEC]: Fix ip_local_out when NETFILTER is off
Thanks for testing with NETFILTER off because I obviously didn't :)
The code for ip_local_out/ip6_local_out is completely broken in
that case.
This patch fixes and also makes the IPsec path use the correct
local_out function so that the loop executes properly and we
don't end up nesting too deep and overrun the stack.
Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
diff --git a/include/net/ip.h b/include/net/ip.h
index dc60ea4..83fb9f1 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -103,11 +103,7 @@ extern int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
extern int ip_do_nat(struct sk_buff *skb);
extern void ip_send_check(struct iphdr *ip);
extern int __ip_local_out(struct sk_buff *skb);
-#ifdef CONFIG_NETFILTER
extern int ip_local_out(struct sk_buff *skb);
-#else
-#define ip_local_out __ip_local_out
-#endif
extern int ip_queue_xmit(struct sk_buff *skb, int ipfragok);
extern void ip_init(void);
extern int ip_append_data(struct sock *sk,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 5078605..e90f962 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -510,11 +510,7 @@ extern int ip6_input(struct sk_buff *skb);
extern int ip6_mc_input(struct sk_buff *skb);
extern int __ip6_local_out(struct sk_buff *skb);
-#ifdef CONFIG_NETFILTER
extern int ip6_local_out(struct sk_buff *skb);
-#else
-#define ip6_local_out __ip6_local_out
-#endif
/*
* Extension header (options) processing
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c652ddb..ad8106c 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -101,7 +101,6 @@ int __ip_local_out(struct sk_buff *skb)
dst_output);
}
-#ifdef CONFIG_NETFILTER
int ip_local_out(struct sk_buff *skb)
{
int err;
@@ -112,7 +111,6 @@ int ip_local_out(struct sk_buff *skb)
return err;
}
-#endif
EXPORT_SYMBOL_GPL(ip_local_out);
/* dev_loopback_xmit for use with netfilter. */
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index d6232df..b4948c1 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -237,7 +237,7 @@ static struct dst_ops xfrm4_dst_ops = {
.update_pmtu = xfrm4_update_pmtu,
.destroy = xfrm4_dst_destroy,
.ifdown = xfrm4_dst_ifdown,
- .local_out = ip_local_out,
+ .local_out = __ip_local_out,
.gc_thresh = 1024,
.entry_size = sizeof(struct xfrm_dst),
};
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a0a366f..45a0f39 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -83,7 +83,6 @@ int __ip6_local_out(struct sk_buff *skb)
dst_output);
}
-#ifdef CONFIG_NETFILTER
int ip6_local_out(struct sk_buff *skb)
{
int err;
@@ -94,7 +93,6 @@ int ip6_local_out(struct sk_buff *skb)
return err;
}
-#endif
EXPORT_SYMBOL_GPL(ip6_local_out);
static int ip6_output_finish(struct sk_buff *skb)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6ee0de1..31456c7 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -253,7 +253,7 @@ static struct dst_ops xfrm6_dst_ops = {
.update_pmtu = xfrm6_update_pmtu,
.destroy = xfrm6_dst_destroy,
.ifdown = xfrm6_dst_ifdown,
- .local_out = ip6_local_out,
+ .local_out = __ip6_local_out,
.gc_thresh = 1024,
.entry_size = sizeof(struct xfrm_dst),
};
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists