xfrm: Generate blackhole routes only from route lookup functions

Browse source

[ Upstream commit f92ee61982 ]

Currently we genarate a blackhole route route whenever we have
matching policies but can not resolve the states. Here we assume
that dst_output() is called to kill the balckholed packets.
Unfortunately this assumption is not true in all cases, so
it is possible that these packets leave the system unwanted.

We fix this by generating blackhole routes only from the
route lookup functions, here we can guarantee a call to
dst_output() afterwards.

Fixes: 2774c131b1 ("xfrm: Handle blackhole route creation via afinfo.")
Reported-by: Konstantinos Kolelis <k.kolelis@sirrix.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Steffen Klassert 2014-09-16 10:08:40 +02:00 • committed by Greg Kroah-Hartman

parent 5fe8352975

commit de541d0ce1

4 changed files with 36 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

15

include/net/dst.h

View file

6

net/ipv4/route.c

View file

4

net/ipv6/ip6_output.c

View file

18

net/xfrm/xfrm_policy.c

View file