[IPSEC]: Set dst->input to dst_discard
authorHerbert Xu <herbert@gondor.apana.org.au>
Wed, 14 Nov 2007 05:35:32 +0000 (21:35 -0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 28 Jan 2008 22:53:40 +0000 (14:53 -0800)
The input function should never be invoked on IPsec dst objects.  This
is because we don't apply IPsec on input until after we've made the
routing decision.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/xfrm4_policy.c
net/ipv6/xfrm6_policy.c

index 7d250a1bd2cfd62aca866bf53c8ead3651a2d92c..c40a71b74dbac84c5b4d0a533b95f97fea5d89ef 100644 (file)
@@ -10,6 +10,7 @@
 
 #include <linux/compiler.h>
 #include <linux/inetdevice.h>
+#include <net/dst.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 
@@ -167,7 +168,7 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                dst_prev->trailer_len   = trailer_len;
                memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
 
-               dst_prev->input         = rt->u.dst.input;
+               dst_prev->input = dst_discard;
                dst_prev->output = dst_prev->xfrm->outer_mode->afinfo->output;
                if (rt0->peer)
                        atomic_inc(&rt0->peer->refcnt);
index bc508d0a87d580736879e39cae680cb5eaca4143..89432279d3a0ac556aa8fe2149e25c6ede778eab 100644 (file)
@@ -14,6 +14,7 @@
 #include <linux/compiler.h>
 #include <linux/netdevice.h>
 #include <net/addrconf.h>
+#include <net/dst.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -214,7 +215,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                dst_prev->trailer_len   = trailer_len;
                memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
 
-               dst_prev->input         = rt->u.dst.input;
+               dst_prev->input = dst_discard;
                dst_prev->output = dst_prev->xfrm->outer_mode->afinfo->output;
                /* Sheit... I remember I did this right. Apparently,
                 * it was magically lost, so this code needs audit */