lkml.org 
[lkml]   [2018]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 007/138] ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Tobias Brunner <tobias@strongswan.org>


    [ Upstream commit 09ee9dba9611cd382fd360a99ad1c2fa23bfdca8 ]

    If SNAT modifies the source address the resulting packet might match
    an IPsec policy, reinject the packet if that's the case.

    The exact same thing is already done for IPv4.

    Signed-off-by: Tobias Brunner <tobias@strongswan.org>
    Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv6/ip6_output.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    --- a/net/ipv6/ip6_output.c
    +++ b/net/ipv6/ip6_output.c
    @@ -138,6 +138,14 @@ static int ip6_finish_output(struct net
    return ret;
    }

    +#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
    + /* Policy lookup after SNAT yielded a new policy */
    + if (skb_dst(skb)->xfrm) {
    + IPCB(skb)->flags |= IPSKB_REROUTED;
    + return dst_output(net, sk, skb);
    + }
    +#endif
    +
    if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
    dst_allfrag(skb_dst(skb)) ||
    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))

    \
     
     \ /
      Last update: 2018-04-11 01:04    [W:4.019 / U:0.180 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site