Re: [PATCH v2] xfrm: Fix inter family IPsec tunnel handling again

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Sat, Jul 05, 2008 at 09:19:50AM +0200, Steffen Klassert wrote:
> Move the selector family initialization behind the check for AF_UNSPEC
> and call xfrm_ip2inner_mode() in any case. So the selector family is
> intitalized and we can choose for the right inner_mode.
> 
> Signed-off-by: Steffen Klassert <steffen.klassert@xxxxxxxxxxx>
> ---
>  net/xfrm/xfrm_input.c |   19 ++++---------------
>  net/xfrm/xfrm_state.c |    2 ++
>  net/xfrm/xfrm_user.c  |    4 ----
>  3 files changed, 6 insertions(+), 19 deletions(-)
> 
> diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
> index 7527940..d220ecf 100644
> --- a/net/xfrm/xfrm_input.c
> +++ b/net/xfrm/xfrm_input.c
> @@ -91,11 +91,9 @@ int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
>  	if (err)
>  		return err;
>  
> -	if (x->sel.family == AF_UNSPEC) {
> -		inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
> -		if (inner_mode == NULL)
> -			return -EAFNOSUPPORT;
> -	}
> +	inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
> +	if (inner_mode == NULL)
> +		return -EAFNOSUPPORT;

If sel.family is specified, inner_mode should already be set, no?
Overriding it would seem insecure.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html