1. 03 Apr, 2008 2 commits
    • Denis V. Lunev's avatar
      [IPV6]: Event type in addrconf_ifdown is mis-used. · 439e2385
      Denis V. Lunev authored
      addrconf_ifdown is broken in respect to the usage of how
      parameter. This function is called with (event != NETDEV_DOWN) and (2)
      on the IPv6 stop.  It the latter case inet6_dev from loopback device
      should be destroyed.
      Signed-off-by: default avatarDenis V. Lunev <den@openvz.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      439e2385
    • Herbert Xu's avatar
      [ICMP]: Ensure that ICMP relookup maintains status quo · af268182
      Herbert Xu authored
      The ICMP relookup path is only meant to modify behaviour when
      appropriate IPsec policies are in place and marked as requiring
      relookups.  It is certainly not meant to modify behaviour when
      IPsec policies don't exist at all.
      
      However, due to an oversight on the error paths existing behaviour
      may in fact change should one of the relookup steps fail.
      
      This patch corrects this by redirecting all errors on relookup
      failures to the previous code path.  That is, if the initial
      xfrm_lookup let the packet pass, we will stand by that decision
      should the relookup fail due to an error.
      
      This should be safe from a security point-of-view because compliant
      systems must install a default deny policy so the packet would'nt
      have passed in that case.
      
      Many thanks to Julian Anastasov for pointing out this error.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      af268182
  2. 02 Apr, 2008 38 commits