Re: [PATCH 2/2] [IPV4] IPSEC: Omit redirect for tunnelled packet.

[David Miller <davem@davemloft.net>]

From: Masahide NAKAMURA <nakam@linux-ipv6.org>
Date: Fri, 24 Aug 2007 19:09:01 +0900

> IPv4 IPsec tunnel gateway incorrectly sends redirect to
> sender if it is onlink host when network device the IPsec tunnelled
> packet is arrived is the same as the one the decapsulated packet
> is sent.
> 
> With this patch, it omits to send the redirect when the forwarding
> skbuff carries secpath, since such skbuff should be assumed as
> a decapsulated packet from IPsec tunnel by own.
> 
> Request for comments:
> Alternatively we'd have another way to change net/ipv4/route.c
> (__mkroute_input) to use RTCF_DOREDIRECT flag unless skbuff
> has no secpath. It is better than this patch at performance
> point of view because IPv4 redirect judgement is done at
> routing slow-path. However, it should be taken care of resource
> changes between SAD(XFRM states) and routing table. In other words,
> When IPv4 SAD is changed does the related routing entry go to its
> slow-path? If not, it is reasonable to apply this patch.
> 
> Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>

Also applied, thank you!