kernel/linux.git/net/ipv4/ah4.c, branch v4.9.331

ipsec: check return value of skb_to_sgvec always

2018-04-13T17:48:31+00:00

commit 3f29770723fe498a5c5f57c3a31a996ebdde03e1 upstream. Signed-off-by: Jason A. Donenfeld Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Signed-off-by: David S. Miller [natechancellor: Adjusted context due to lack of fca11ebde3f0] Signed-off-by: Nathan Chancellor Signed-off-by: Greg Kroah-Hartman

IPsec: do not ignore crypto err in ah4 input

2017-11-15T14:53:15+00:00

[ Upstream commit ebd89a2d0675f1325c2be5b7576fd8cb7e8defd0 ] ah4 input processing uses the asynchronous hash crypto API which supplies an error code as part of the operation completion but the error code was being ignored. Treat a crypto API error indication as a verification failure. While a crypto API reported error would almost certainly result in a memcpy of the digest failing anyway and thus the security risk seems minor, performing a memory compare on what might be uninitialized memory is wrong. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ah4: Fix error return in ah_input().

2015-08-25T20:38:50+00:00

Noticed by Herbert Xu. Signed-off-by: David S. Miller

ipsec: Remove obsolete MAX_AH_AUTH_LEN

2014-09-18T08:54:36+00:00

While tracking down the MAX_AH_AUTH_LEN crash in an old kernel I thought that this limit was rather arbitrary and we should just get rid of it. In fact it seems that we've already done all the work needed to remove it apart from actually removing it. This limit was there in order to limit stack usage. Since we've already switched over to allocating scratch space using kmalloc, there is no longer any need to limit the authentication length. This patch kills all references to it, including the BUG_ONs that led me here. Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert

ah4: Use the IPsec protocol multiplexer API

2014-02-25T06:04:17+00:00

Switch ah4 to use the new IPsec protocol multiplexer. Signed-off-by: Steffen Klassert

{IPv4,xfrm} Add ESN support for AH ingress part

2014-02-12T06:02:10+00:00

This patch add esn support for AH input stage by attaching upper 32bits sequence number right after packet payload as specified by RFC 4302. Then the ICV value will guard upper 32bits sequence number as well when packet getting in. Signed-off-by: Fan Du Signed-off-by: Steffen Klassert

{IPv4,xfrm} Add ESN support for AH egress part

2014-02-12T06:02:10+00:00

This patch add esn support for AH output stage by attaching upper 32bits sequence number right after packet payload as specified by RFC 4302. Then the ICV value will guard upper 32bits sequence number as well when packet going out. Signed-off-by: Fan Du Signed-off-by: Steffen Klassert

ipv4: properly refresh rtable entries on pmtu/redirect events

2013-06-03T07:07:42+00:00

This reverts commit 05ab86c5 (xfrm4: Invalidate all ipv4 routes on IPsec pmtu events). Flushing all cached entries is not needed. Instead, invalidate only the related next hop dsts to recheck for the added next hop exception where needed. This also fixes a subtle race due to bumping generation id's before updating the pmtu. Cc: Steffen Klassert Signed-off-by: Timo Teräs Signed-off-by: David S. Miller

net: Add skb_unclone() helper function.

2013-02-15T20:10:37+00:00

This function will be used in next GRE_GSO patch. This patch does not change any functionality. Signed-off-by: Pravin B Shelar Acked-by: Eric Dumazet

xfrm4: Invalidate all ipv4 routes on IPsec pmtu events

2013-01-21T11:43:54+00:00

On IPsec pmtu events we can't access the transport headers of the original packet, so we can't find the socket that sent the packet. The only chance to notify the socket about the pmtu change is to force a relookup for all routes. This patch implenents this for the IPsec protocols. Signed-off-by: Steffen Klassert