xfrm: Generate blackhole routes only from route lookup functions
authorSteffen Klassert <steffen.klassert@secunet.com>
Tue, 16 Sep 2014 08:08:40 +0000 (10:08 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 16 Sep 2014 08:08:40 +0000 (10:08 +0200)
commitf92ee61982d6da15a9e49664ecd6405a15a2ee56
tree014f5e6b027f1446b5bda041382b30262868bf86
parent95cd6f488d164de462a8279e802a0ad05c33d167
xfrm: Generate blackhole routes only from route lookup functions

Currently we genarate a blackhole route route whenever we have
matching policies but can not resolve the states. Here we assume
that dst_output() is called to kill the balckholed packets.
Unfortunately this assumption is not true in all cases, so
it is possible that these packets leave the system unwanted.

We fix this by generating blackhole routes only from the
route lookup functions, here we can guarantee a call to
dst_output() afterwards.

Fixes: 2774c131b1d ("xfrm: Handle blackhole route creation via afinfo.")
Reported-by: Konstantinos Kolelis <k.kolelis@sirrix.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
include/net/dst.h
net/ipv4/route.c
net/ipv6/ip6_output.c
net/xfrm/xfrm_policy.c