]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
xfrm: interface: fix the priorities for ipip and ipv6 tunnels
authorXin Long <lucien.xin@gmail.com>
Thu, 8 Oct 2020 08:13:24 +0000 (16:13 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 18 Nov 2020 18:21:59 +0000 (19:21 +0100)
commitf294984df764a802e7c9cf5d2bdcb80cfca2c1dd
tree7b4a0a74832e4fb55461460c8a16ba6bf38b3a8e
parentbf375d7cd302856c76d40b9a569a278e7fe9781e
xfrm: interface: fix the priorities for ipip and ipv6 tunnels

[ Upstream commit 7fe94612dd4cfcd35fe0ec87745fb31ad2be71f8 ]

As Nicolas noticed in his case, when xfrm_interface module is installed
the standard IP tunnels will break in receiving packets.

This is caused by the IP tunnel handlers with a higher priority in xfrm
interface processing incoming packets by xfrm_input(), which would drop
the packets and return 0 instead when anything wrong happens.

Rather than changing xfrm_input(), this patch is to adjust the priority
for the IP tunnel handlers in xfrm interface, so that the packets would
go to xfrmi's later than the others', as the others' would not drop the
packets when the handlers couldn't process them.

Note that IPCOMP also defines its own IPIP tunnel handler and it calls
xfrm_input() as well, so we must make its priority lower than xfrmi's,
which means having xfrmi loaded would still break IPCOMP. We may seek
another way to fix it in xfrm_input() in the future.

Reported-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Tested-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Fixes: da9bbf0598c9 ("xfrm: interface: support IPIP and IPIP6 tunnels processing with .cb_handler")
FIxes: d7b360c2869f ("xfrm: interface: support IP6IP6 and IP6IP tunnels processing with .cb_handler")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv4/xfrm4_tunnel.c
net/ipv6/xfrm6_tunnel.c
net/xfrm/xfrm_interface.c