Commit aebcf82c authored Dec 12, 2007 by Herbert Xu Committed by David S. Miller Jan 28, 2008

[IPSEC]: Do not let packets pass when ICMP flag is off



This fixes a logical error in ICMP policy checks which lets
packets through if the state ICMP flag is off.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent bb72845e

net/ipv4/icmp.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -977,10 +977,13 @@ int icmp_rcv(struct sk_buff *skb)
		struct icmphdr *icmph;
		struct rtable rt = (struct rtable )skb->dst;

		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb) && skb->sp &&
		skb->sp->xvec[skb->sp->len - 1]->props.flags & XFRM_STATE_ICMP) {
		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
		int nh;

		if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
		XFRM_STATE_ICMP))
		goto drop;

		if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
		goto drop;

net/ipv6/icmp.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -644,10 +644,13 @@ static int icmpv6_rcv(struct sk_buff *skb)
		struct icmp6hdr *hdr;
		int type;

		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb) && skb->sp &&
		skb->sp->xvec[skb->sp->len - 1]->props.flags & XFRM_STATE_ICMP) {
		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
		int nh;

		if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
		XFRM_STATE_ICMP))
		goto drop_no_count;

		if (!pskb_may_pull(skb, sizeof(hdr) + sizeof(orig_hdr)))
		goto drop_no_count;