netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* Bug in ipv6 ipsec  in handling of packets with extension headers
@ 2003-06-05 12:25 Henrik Petander
  2003-06-05 12:17 ` David S. Miller
  0 siblings, 1 reply; 6+ messages in thread
From: Henrik Petander @ 2003-06-05 12:25 UTC (permalink / raw)
  To: netdev

Hi,

There's a bug in get_offset function of ah6 and esp6. The function 
returns also a pointer, prev_hdr, pointing to the last extension header 
before the IPSec headers. This pointer points to the skb. The ipsec 
headers go between the payload and the extension header, making the 
pointer invalid. However, after this the pointer is used for setting the 
next header field of the extension header to IPPROTO_ESP or IPPROTO_AH. 
This corrupts the packet, if any extension headers are present.

An easy way to test this is to send a data packet with routing header 
protected by IPSec.

A possible fix is to change the pointer into an offset from the start of 
the packet and use the offset later to set the nexthdr value in the 
extension header.

Thanks,

Henrik

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2003-06-07  9:22 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-06-05 12:25 Bug in ipv6 ipsec in handling of packets with extension headers Henrik Petander
2003-06-05 12:17 ` David S. Miller
2003-06-05 12:59   ` Henrik Petander
2003-06-05 16:54     ` Mitsuru KANDA / 神田 充
2003-06-06 18:17     ` [PATCH] fix esp6 extension headers handling Mitsuru KANDA / 神田 充
2003-06-07  9:22       ` David S. Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).