• Patrick McHardy's avatar
    [XFRM]: Fix SNAT-related crash in xfrm4_output_finish · 48d5cad8
    Patrick McHardy authored
    
    
    When a packet matching an IPsec policy is SNATed so it doesn't match any
    policy anymore it looses its xfrm bundle, which makes xfrm4_output_finish
    crash because of a NULL pointer dereference.
    
    This patch directs these packets to the original output path instead. Since
    the packets have already passed the POST_ROUTING hook, but need to start at
    the beginning of the original output path which includes another
    POST_ROUTING invocation, a flag is added to the IPCB to indicate that the
    packet was rerouted and doesn't need to pass the POST_ROUTING hook again.
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    48d5cad8
netfilter.h 9.44 KB