diff options
| author | Sowmini Varadhan <sowmini.varadhan@oracle.com> | 2018-09-03 04:36:52 -0700 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2018-09-04 10:26:30 +0200 |
| commit | bfc0698bebcb16d19ecfc89574ad4d696955e5d3 (patch) | |
| tree | 0d9c1235fdf027900ee386cd2765339323d55faf /net/ipv4/xfrm4_input.c | |
| parent | 215ab0f021c9fea3c18b75e7d522400ee6a49990 (diff) | |
| download | linux-stable-bfc0698bebcb16d19ecfc89574ad4d696955e5d3.tar.gz linux-stable-bfc0698bebcb16d19ecfc89574ad4d696955e5d3.tar.bz2 linux-stable-bfc0698bebcb16d19ecfc89574ad4d696955e5d3.zip | |
xfrm: reset transport header back to network header after all input transforms ahave been applied
A policy may have been set up with multiple transforms (e.g., ESP
and ipcomp). In this situation, the ingress IPsec processing
iterates in xfrm_input() and applies each transform in turn,
processing the nexthdr to find any additional xfrm that may apply.
This patch resets the transport header back to network header
only after the last transformation so that subsequent xfrms
can find the correct transport header.
Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Suggested-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/ipv4/xfrm4_input.c')
| -rw-r--r-- | net/ipv4/xfrm4_input.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c index bcfc00e88756..f8de2482a529 100644 --- a/net/ipv4/xfrm4_input.c +++ b/net/ipv4/xfrm4_input.c @@ -67,6 +67,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) if (xo && (xo->flags & XFRM_GRO)) { skb_mac_header_rebuild(skb); + skb_reset_transport_header(skb); return 0; } |