Re: [PATCH] sctp: IPsec rules are ineffective with ipv6

[Nicolas Dichtel <nicolas.dichtel@dev.6wind.com>]

[-- Attachment #1: Type: text/plain, Size: 1052 bytes --]

What about this one?

Only compilation tested.

xfrm_lookup() is missing in IPv6 output path. Call it when dst is build. Initial 
patch was written by Junwei Zhang <junwei.zhang@6wind.com>

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>

Le 28.01.2010 16:24, Vlad Yasevich a écrit :
> 
> David Miller wrote:
>> From: Nicolas Dichtel <nicolas.dichtel@dev.6wind.com>
>> Date: Wed, 27 Jan 2010 15:12:59 +0100
>>
>>> xfrm_lookup() is missing in sctp_v6_xmit(), add it.
>>>
>>> Signed-off-by: Junwei Zhang <junwei.zhang@6wind.com>
>>> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>> Doing this every transmit packet is overkill.
>>
>> Whatever calculates the route that ends up in skb_dst(skb)
>> should be making this xfrm_lookup() call, not here.
>>
> 
> 
> Hmm.. Interesting.  Looks like ip_route_output_key() will
> do xfrm_lookup for you, but there is no ipv6 route lookup call
> that will do the same thing.
> 
> I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().
> 
> -vlad

[-- Attachment #2: x2.diff --]
[-- Type: text/x-diff, Size: 810 bytes --]

diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index cc50fbe..4081ffb 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -258,13 +258,14 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
 	}
 
 	dst = ip6_route_output(&init_net, NULL, &fl);
-	if (!dst->error) {
-		struct rt6_info *rt;
-		rt = (struct rt6_info *)dst;
-		SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
-			&rt->rt6i_dst.addr, &rt->rt6i_src.addr);
-		return dst;
-	}
+	if (!dst->error)
+		if (xfrm_lookup(&init_net, &dst, &fl, asoc ? asoc->base.sk : NULL, 0) >= 0) {
+			struct rt6_info *rt;
+			rt = (struct rt6_info *)dst;
+			SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
+				&rt->rt6i_dst.addr, &rt->rt6i_src.addr);
+			return dst;
+		}
 	SCTP_DEBUG_PRINTK("NO ROUTE\n");
 	dst_release(dst);
 	return NULL;