linux/net
Arnaud Ebalard d9a9dc66eb IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input())
The input handler for Type 2 Routing Header (mip6_rthdr_input())
checks if the CoA in the packet matches the CoA in the XFRM state.

Current check is buggy: it compares the adddress in the Type 2
Routing Header, i.e. the HoA, against the expected CoA in the state.
The comparison should be made against the address in the destination
field of the IPv6 header.

The bug remained unnoticed because the main (and possibly only current)
user of the code (UMIP MIPv6 Daemon) initializes the XFRM state with the
unspecified address, i.e. explicitly allows everything.

Yoshifuji-san, can you ack that one?

Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18 15:04:33 -07:00
..
9p kernel-wide: replace USHORT_MAX, SHORT_MAX and SHORT_MIN with USHRT_MAX, SHRT_MAX and SHRT_MIN 2010-05-25 08:07:02 -07:00
802 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
8021q net: deliver skbs on inactive slaves to exact matches 2010-06-10 22:23:34 -07:00
appletalk Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
atm net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
ax25 net: sk_sleep() helper 2010-04-20 16:37:13 -07:00
bluetooth Bluetooth: Update sec_level/auth_type for already existing connections 2010-07-08 20:35:31 -03:00
bridge bridge: Clear IPCB before possible entry into IP stack 2010-07-07 14:43:33 -07:00
caif caif: fix a couple range checks 2010-06-09 16:18:53 -07:00
can net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
core net: fix problem in reading sock TX queue 2010-07-14 20:50:29 -07:00
dcb include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-25 16:59:51 -07:00
decnet net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
dsa dsa: Fix Kconfig dependencies. 2010-07-12 20:03:42 -07:00
econet include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
ethernet net: Inline skb_pull() in eth_type_trans(). 2010-05-02 02:21:44 -07:00
ieee802154 ieee802154: Fix possible NULL pointer dereference in wpan_phy_alloc 2010-05-23 23:11:07 -07:00
ipv4 ipmr: Don't leak memory if fib lookup fails. 2010-07-15 22:38:43 -07:00
ipv6 IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input()) 2010-07-18 15:04:33 -07:00
ipx include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
irda net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
iucv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-28 10:18:40 -07:00
key pfkey: add severity to printk 2010-05-17 23:23:13 -07:00
l2tp l2tp_eth: fix memory allocation 2010-04-23 16:37:33 -07:00
lapb include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
llc Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-12 00:05:35 -07:00
mac80211 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2010-06-16 13:41:55 -07:00
netfilter ipvs: Add missing locking during connection table hashing and unhashing 2010-06-09 16:10:57 +02:00
netlabel net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
netlink netlink: Implment netlink_broadcast_filtered 2010-05-21 09:37:32 -07:00
netrom net: sk_sleep() helper 2010-04-20 16:37:13 -07:00
packet Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-21 01:14:25 -07:00
phonet Phonet: fix skb leak in pipe endpoint accept() 2010-07-08 21:45:34 -07:00
rds net/rds: Add missing mutex_unlock 2010-05-29 00:18:48 -07:00
rfkill Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
rose net: sk_sleep() helper 2010-04-20 16:37:13 -07:00
rxrpc net: sock_def_readable() and friends RCU conversion 2010-05-01 15:00:15 -07:00
sched act_nat: not all of the ICMP packets need an IP header payload 2010-07-12 20:00:19 -07:00
sctp net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
sunrpc sunrpc: fix leak on error on socket xprt setup 2010-05-26 08:43:50 -04:00
tipc tipc: Reduce footprint by un-inlining tipc_msg_* routines 2010-05-12 23:02:29 -07:00
unix unix/garbage: kill copy of the skb queue walker 2010-05-03 15:39:58 -07:00
wanrouter headers: smp_lock.h redux 2009-07-12 12:22:34 -07:00
wimax Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 2010-05-20 21:04:44 -07:00
wireless cfg80211: add missing braces 2010-05-21 14:40:01 -04:00
x25 X25: Remove bkl in sockopts 2010-05-17 17:39:28 -07:00
xfrm xfrm: do not assume that template resolving always returns xfrms 2010-07-14 14:16:48 -07:00
Kconfig net/sysfs: Fix the bitrot in network device kobject namespace support 2010-05-21 09:37:32 -07:00
Makefile l2tp: Split pppol2tp patch into separate l2tp and ppp parts 2010-04-03 14:56:02 -07:00
TUNABLE
compat.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
nonet.c
socket.c cls_cgroup: Store classid in struct sock 2010-05-24 00:12:34 -07:00
sysctl_net.c net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00