[9/*] [IPSEC] Check dst validity harder in xfrm_bundle_ok

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Sun, Mar 06, 2005 at 09:32:14PM -0800, David S. Miller wrote:
> 
> Applied, but with a bug fix:
> 
> +             mtu = dst_pmtu(xdst->route);
> +             if (xdst->child_mtu_cached != mtu) {
> +                     last = xdst;
> +                     xdst->route_mtu_cached = mtu;
> +             }
> 
> You obviously meant "route_mtu_cached" in the test,
> not child_mtu_cached.

Thanks for catching this.

There is another bug in xfrm_bundle_ok where I forgot to
check the validity of xdst->route.  In fact, the check
on dst->path isn't strong enough either.  For IPv6 entries,
dst->path->obsolete is always negative until you call
ipv6_dst_check.  So we really need to do that here.

Here's the patch to fix those two problems.  Yes I know
my dst_check implementation is lame.  I'll come back and
fix up all the dst_check functions by moving their dst_release
calls out.  It proves that you were right in that IPv6 dst
leak thread :)

Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

xfrm-9
Description: Text document