xfrm: Fix crash with ipv6 IPsec tunnel and NAT.
authorSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Apr 2014 06:08:52 +0000 (08:08 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Apr 2014 08:52:38 +0000 (10:52 +0200)
commit5596732fa8c14139018ecda8356eabbfb599d830
treed4d4a5178f22ee795e2e7a44b1ca49fb0dc209fc
parentd80e773f16f66a610e04f6875d4da84e74a8fb6c
xfrm: Fix crash with ipv6 IPsec tunnel and NAT.

The ipv6 xfrm output path is not aware that packets can be
rerouted by NAT to not use IPsec. We crash in this case
because we expect to have a xfrm state at the dst_entry.
This crash happens if the ipv6 layer does IPsec and NAT
or if we have an interfamily IPsec tunnel with ipv4 NAT.

We fix this by checking for a NAT rerouted packet in each
address family and dst_output() to the new destination
in this case.

Reported-by: Martin Pelikan <martin.pelikan@gmail.com>
Tested-by: Martin Pelikan <martin.pelikan@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/ipv4/xfrm4_output.c
net/ipv6/xfrm6_output.c