On Fri, Dec 15, 2017 at 04:40:44PM +1100, Herbert Xu wrote: > This is an old bugbear of mine: > > https://www.mail-archive.com/netdev@vger.kernel.org/msg03894.html > > By crafting special packets, it is possible to cause recursion > in our kernel when processing transport-mode packets at levels > that are only limited by packet size. > > The easiest one is with DNAT, but an even worse one is where > UDP encapsulation is used in which case you just have to insert > an UDP encapsulation header in between each level of recursion. > > This patch avoids this problem by reinjecting tranport-mode packets > through a tasklet. > > Fixes: b05e106698d9 ("[IPV4/6]: Netfilter IPsec input hooks") > Signed-off-by: Herbert Xu <herb...@gondor.apana.org.au>
Applied to the ipsec tree, thanks Herbert!
