← Back to branch summary

~ubuntu-branches/ubuntu/hardy/openswan/hardy-updates

« back to all changes in this revision

Viewing changes to linux/net/ipsec/ipsec_sa.c

  • Committer: Bazaar Package Importer
  • Author(s): Rene Mayrhofer
  • Date: 2005-01-27 16:10:11 UTC
  • mfrom: (1.1.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20050127161011-idgybmyz3vwhpfiq
Tags: 2.3.0-2
http://bugs.debian.org/292458
http://bugs.debian.org/291143
Urgency HIGH due to security issue and problems with build-deps in sarge.
* Fix the security issue. Please see
  http://www.idefense.com/application/poi/display?id=190&
      type=vulnerabilities&flashstatus=false
  for more details. Thanks to Martin Schulze for informing me about
  this issue.
  Closes: #292458: Openswan XAUTH/PAM Buffer Overflow Vulnerability
* Added a Build-Dependency to lynx.
  Closes: #291143: openswan: FTBFS: Missing build dependency.

Show diffs side-by-side

added added

removed removed

Lines of Context:
linux/net/ipsec/ipsec_sa.c
14
14
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
15
15
 * for more details.
16
16
 *
17
 
 * RCSID $Id: ipsec_sa.c,v 1.22 2003/12/10 01:14:27 mcr Exp $
 
17
 * RCSID $Id: ipsec_sa.c,v 1.25 2004/08/22 20:12:16 mcr Exp $
18
18
 *
19
19
 * This is the file formerly known as "ipsec_xform.h"
20
20
 *
24
24
#include <linux/version.h>
25
25
#include <linux/kernel.h> /* printk() */
26
26
 
27
 
#include "freeswan/ipsec_param.h"
 
27
#include "openswan/ipsec_param.h"
28
28
 
29
29
#ifdef MALLOC_SLAB
30
30
# include <linux/slab.h> /* kmalloc() */
40
40
#include <linux/etherdevice.h> /* eth_type_trans */
41
41
#include <linux/ip.h>          /* struct iphdr */
42
42
#include <linux/skbuff.h>
43
 
#include <freeswan.h>
 
43
#include <openswan.h>
44
44
#ifdef SPINLOCK
45
45
#ifdef SPINLOCK_23
46
46
#include <linux/spinlock.h> /* *lock* */
55
55
#include <asm/checksum.h>
56
56
#include <net/ip.h>
57
57
 
58
 
#include "freeswan/radij.h"
59
 
 
60
 
#include "freeswan/ipsec_stats.h"
61
 
#include "freeswan/ipsec_life.h"
62
 
#include "freeswan/ipsec_sa.h"
63
 
#include "freeswan/ipsec_xform.h"
64
 
 
65
 
#include "freeswan/ipsec_encap.h"
66
 
#include "freeswan/ipsec_radij.h"
67
 
#include "freeswan/ipsec_xform.h"
68
 
#include "freeswan/ipsec_ipe4.h"
69
 
#include "freeswan/ipsec_ah.h"
70
 
#include "freeswan/ipsec_esp.h"
 
58
#include "openswan/radij.h"
 
59
 
 
60
#include "openswan/ipsec_stats.h"
 
61
#include "openswan/ipsec_life.h"
 
62
#include "openswan/ipsec_sa.h"
 
63
#include "openswan/ipsec_xform.h"
 
64
 
 
65
#include "openswan/ipsec_encap.h"
 
66
#include "openswan/ipsec_radij.h"
 
67
#include "openswan/ipsec_xform.h"
 
68
#include "openswan/ipsec_ipe4.h"
 
69
#include "openswan/ipsec_ah.h"
 
70
#include "openswan/ipsec_esp.h"
71
71
 
72
72
#include <pfkeyv2.h>
73
73
#include <pfkey.h>
74
74
 
75
 
#include "freeswan/ipsec_proto.h"
76
 
 
77
 
 
78
 
#ifdef CONFIG_IPSEC_DEBUG
 
75
#include "openswan/ipsec_proto.h"
 
76
#include "openswan/ipsec_alg.h"
 
77
 
 
78
 
 
79
#ifdef CONFIG_KLIPS_DEBUG
79
80
int debug_xform = 0;
80
 
#endif /* CONFIG_IPSEC_DEBUG */
 
81
#endif /* CONFIG_KLIPS_DEBUG */
81
82
 
82
83
#define SENDERR(_x) do { error = -(_x); goto errlab; } while (0)
83
84
 
983
984
        ips->ips_key_a = NULL;
984
985
 
985
986
        if(ips->ips_key_e != NULL) {
 
987
#ifdef CONFIG_KLIPS_ALG
 
988
                if (ips->ips_alg_enc&&ips->ips_alg_enc->ixt_e_destroy_key) {
 
989
                        ips->ips_alg_enc->ixt_e_destroy_key(ips->ips_alg_enc, 
 
990
                                        ips->ips_key_e);
 
991
                } else {
 
992
#endif /* CONFIG_KLIPS_ALG */
986
993
                memset((caddr_t)(ips->ips_key_e), 0, ips->ips_key_e_size);
987
994
                kfree(ips->ips_key_e);
 
995
#ifdef CONFIG_KLIPS_ALG
 
996
                }
 
997
#endif /* CONFIG_KLIPS_ALG */
988
998
        }
989
999
        ips->ips_key_e = NULL;
990
1000
 
1009
1019
                kfree(ips->ips_ident_d.data);
1010
1020
        }
1011
1021
        ips->ips_ident_d.data = NULL;
 
1022
 
 
1023
#ifdef CONFIG_KLIPS_ALG
 
1024
        if (ips->ips_alg_enc||ips->ips_alg_auth) {
 
1025
                ipsec_alg_sa_wipe(ips);
 
1026
        }
 
1027
#endif /* CONFIG_KLIPS_ALG */
1012
1028
        
1013
1029
        memset((caddr_t)ips, 0, sizeof(*ips));
1014
1030
        kfree(ips);
1019
1035
 
1020
1036
/*
1021
1037
 * $Log: ipsec_sa.c,v $
 
1038
 * Revision 1.25  2004/08/22 20:12:16  mcr
 
1039
 *      one more KLIPS_NAT->IPSEC_NAT.
 
1040
 *
 
1041
 * Revision 1.24  2004/07/10 19:11:18  mcr
 
1042
 *      CONFIG_IPSEC -> CONFIG_KLIPS.
 
1043
 *
 
1044
 * Revision 1.23  2004/04/06 02:49:26  mcr
 
1045
 *      pullup of algo code from alg-branch.
 
1046
 *
 
1047
 * Revision 1.22.2.1  2003/12/22 15:25:52  jjo
 
1048
 * . Merged algo-0.8.1-rc11-test1 into alg-branch
 
1049
 *
1022
1050
 * Revision 1.22  2003/12/10 01:14:27  mcr
1023
1051
 *      NAT-traversal patches to KLIPS.
1024
1052
 *