Re: ipip and ip_gre encapsulation bugs

2006-09-13 Thread David Miller
From: Al Viro <[EMAIL PROTECTED]> Date: Thu, 14 Sep 2006 02:16:37 +0100 > OK, after rereading the RFC... Pointer field is one octet, indeed. > Avoiding all swapping will be tough - icmp_send() takes 32bit argument, > net-endian. Thanks for the fix Al, but did you notice that this code is totally

Re: ipip and ip_gre encapsulation bugs

2006-09-13 Thread Al Viro
On Thu, Sep 14, 2006 at 10:23:42AM +1000, Herbert Xu wrote: > > - if (skb->h.icmph->un.gateway < (iph->ihl<<2)) > > + n = ntohl(skb->h.icmph->un.gateway); > > + if (n < (iph->ihl<<2)) > >return; > > I don't think this is right. The

Re: ipip and ip_gre encapsulation bugs

2006-09-13 Thread Herbert Xu
Al Viro <[EMAIL PROTECTED]> wrote: > Handling of ipip and ip_gre ICMP error relaying is b0rken; it accesses > 32bit net-endian field as host-endian, does comparison, subtraction and > stuffs the result to 32bit net-endian. Without any conversions. Thanks for spotting this. > @@ -422,14 +423,16 @