ipsec through openvpn broken

its) Raw packet data Internet Protocol Version 4, Src: xx.xx.xx.xx, Dst: zz.zz.zz.zz User Datagram Protocol, Src Port: 4500, Dst Port: 4500 UDP Encapsulation of IPsec Packets Encapsulating Security Payload ESP SPI: 0xc4bbc7d8 (3300640728) ESP Sequence: 29 -- Regards, Artem Savkov

Re: [PATCH] xfrm: init skb_head lock for transport-mode packets

On Thu, Jan 04, 2018 at 10:01:32PM +1100, Herbert Xu wrote: > On Thu, Jan 04, 2018 at 11:36:28AM +0100, Artem Savkov wrote: > > Commit acf568ee859f "xfrm: Reinject transport-mode packets through tasklet" > > adds an sk_buff_head queue, but never initializes trans->queu

[PATCH] xfrm: init skb_head lock for transport-mode packets

kb_queue_head_init() to properly initialize said lock. Signed-off-by: Artem Savkov --- net/xfrm/xfrm_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 26b10eb7a206..d5389b9dbbb9 100644 --- a/net/xfrm/xfrm_input.c +++

[PATCH] xfrm: don't call xfrm_policy_cache_flush under xfrm_state_lock

30d78c14a8 xfrm: add xdst pcpu cache Signed-off-by: Artem Savkov --- net/xfrm/xfrm_state.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 0dab1cd79ce4..12213477cd3a 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_s

[PATCH v3] ebtables: fix race condition in frame_filter_net_init()

: Artem Savkov --- include/linux/netfilter_bridge/ebtables.h | 7 --- net/bridge/netfilter/ebtable_broute.c | 4 ++-- net/bridge/netfilter/ebtable_filter.c | 4 ++-- net/bridge/netfilter/ebtable_nat.c| 4 ++-- net/bridge/netfilter/ebtables.c | 17

[PATCH v2] ebtables: fix race condition in frame_filter_net_init()

It is possible for ebt_in_hook to be triggered before ebt_table is assigned resulting in a NULL-pointer dereference. Make sure hooks are registered as the last step. Fixes: aee12a0a3727 ebtables: remove nf_hook_register usage Signed-off-by: Artem Savkov --- include/linux/netfilter_bridge

Re: [PATCH] ebtables: fix race condition in frame_filter_net_init()

On Tue, Sep 26, 2017 at 02:42:11PM +0200, Florian Westphal wrote: > Artem Savkov wrote: > > It is possible for ebt_in_hook to be triggered before ebt_table is assigned > > resulting in a NULL-pointer dereference. Make sure hooks are > > registered as the last step. >

[PATCH] ebtables: fix race condition in frame_filter_net_init()

It is possible for ebt_in_hook to be triggered before ebt_table is assigned resulting in a NULL-pointer dereference. Make sure hooks are registered as the last step. Fixes: aee12a0a3727 ebtables: remove nf_hook_register usage Signed-off-by: Artem Savkov --- include/linux/netfilter_bridge

Re: [PATCH net v2] udp: preserve skb->dst if required for IP options processing

On Tue, Jul 18, 2017 at 11:57:55AM +0200, Paolo Abeni wrote: > Eric noticed that in udp_recvmsg() we still need to access > skb->dst while processing the IP options. > Since commit 0a463c78d25b ("udp: avoid a cache miss on dequeue") > skb->dst is no more available at recvmsg() time and bad things >

Re: [PATCH] ip6_offload: check segs for NULL in ipv6_gso_segment.

On Thu, Dec 01, 2016 at 06:34:07AM -0800, Eric Dumazet wrote: > On Thu, 2016-12-01 at 14:06 +0100, Artem Savkov wrote: > > segs needs to be checked for being NULL in ipv6_gso_segment() before calling > > skb_shinfo(segs), otherwise kernel can run into a NULL-pointer dereference: &

[PATCH] ip6_offload: check segs for NULL in ipv6_gso_segment.

2d78d0 ]--- Signed-off-by: Artem Savkov --- net/ipv6/ip6_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 1fcf61f..89c59e6 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -99,7 +99,7 @@ static