6925223ab3
[ Upstream commit 30791ac41927ebd3e75486f9504b6d2280463bf0 ]
The MD5-key that belongs to a connection is identified by the peer's
IP-address. When we are in tcp_v4(6)_reqsk_send_ack(), we are replying
to an incoming segment from tcp_check_req() that failed the seq-number
checks.
Thus, to find the correct key, we need to use the skb's saddr and not
the daddr.
This bug seems to have been there since quite a while, but probably got
unnoticed because the consequences are not catastrophic. We will call
tcp_v4_reqsk_send_ack only to send a challenge-ACK back to the peer,
thus the connection doesn't really fail.
Fixes:
|
||
|---|---|---|
| .. | ||
| netfilter | ||
| addrconf_core.c | ||
| addrconf.c | ||
| addrlabel.c | ||
| af_inet6.c | ||
| ah6.c | ||
| anycast.c | ||
| datagram.c | ||
| esp6.c | ||
| exthdrs_core.c | ||
| exthdrs_offload.c | ||
| exthdrs.c | ||
| fib6_rules.c | ||
| icmp.c | ||
| ila.c | ||
| inet6_connection_sock.c | ||
| inet6_hashtables.c | ||
| ip6_checksum.c | ||
| ip6_fib.c | ||
| ip6_flowlabel.c | ||
| ip6_gre.c | ||
| ip6_icmp.c | ||
| ip6_input.c | ||
| ip6_offload.c | ||
| ip6_offload.h | ||
| ip6_output.c | ||
| ip6_tunnel.c | ||
| ip6_udp_tunnel.c | ||
| ip6_vti.c | ||
| ip6mr.c | ||
| ipcomp6.c | ||
| ipv6_sockglue.c | ||
| Kconfig | ||
| Makefile | ||
| mcast_snoop.c | ||
| mcast.c | ||
| mip6.c | ||
| ndisc.c | ||
| netfilter.c | ||
| output_core.c | ||
| ping.c | ||
| proc.c | ||
| protocol.c | ||
| raw.c | ||
| reassembly.c | ||
| route.c | ||
| sit.c | ||
| syncookies.c | ||
| sysctl_net_ipv6.c | ||
| tcp_ipv6.c | ||
| tcpv6_offload.c | ||
| tunnel6.c | ||
| udp_impl.h | ||
| udp_offload.c | ||
| udp.c | ||
| udplite.c | ||
| xfrm6_input.c | ||
| xfrm6_mode_beet.c | ||
| xfrm6_mode_ro.c | ||
| xfrm6_mode_transport.c | ||
| xfrm6_mode_tunnel.c | ||
| xfrm6_output.c | ||
| xfrm6_policy.c | ||
| xfrm6_protocol.c | ||
| xfrm6_state.c | ||
| xfrm6_tunnel.c | ||