From: bill4carson@gmail.com (bill4carson)
To: kernelnewbies@lists.kernelnewbies.org
Subject: Question about tunnels, IPsec and redirect
Date: Thu, 26 Sep 2013 15:02:52 +0800 [thread overview]
Message-ID: <5243DC1C.6040200@gmail.com> (raw)
In-Reply-To: <CAGXs5wUWQvD6LDereqhNcA23c6yQ90HfDbup67uDkq7xb_V54Q@mail.gmail.com>
Hi Kevin
On 2013?09?25? 02:52, Kevin Wilson wrote:
> Hi,
> I am looking at this patch:
> http://lists.openwall.net/netdev/2007/08/24/29
> and I cannot understand it. Can somebody please try
> to explain ?
> more specifically:
> Can somebody please give an example of some setup of IPsec tunnel
> where the ip_rt_send_redirect() method should not be called when the
> skb->sp is not NULL ?
+ if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb->sp)
^^^^^^^
If IPsec policy is not enabled for a specific flow that this skb matches, skb->sp is NULL.
> (in other words, why if the SKB is and IPsec SKB, we should not send a
> redirect in such a case while forwarding a packet; note I am talking
> about IPv4)
>
> Note that the check for skb->sp was changed in recent kernels to
> skb_sec_path(skb), but it is essentially the same.
>
>
> Regards,
> Kevin
>
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>
--
?????????,??????????
--bill
next prev parent reply other threads:[~2013-09-26 7:02 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-24 18:52 Question about tunnels, IPsec and redirect Kevin Wilson
2013-09-26 7:02 ` bill4carson [this message]
2013-09-26 7:31 ` Kevin Wilson
2013-09-29 2:23 ` bill4carson
2013-09-29 2:36 ` bill4carson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5243DC1C.6040200@gmail.com \
--to=bill4carson@gmail.com \
--cc=kernelnewbies@lists.kernelnewbies.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).