RFC: consistent disable_xfrm behaviour

RFC: consistent disable_xfrm behaviour

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 705 bytes --]

Currently the behaviour of disable_xfrm is inconsistent between
locally generated and forwarded packets. For locally generated
packets disable_xfrm disables the policy lookup if it is set on
the output device, for forwarded traffic however it looks at the
input device. This makes it impossible to disable xfrm on all
devices but a dummy device and use normal routing to direct
traffic to that device.

The Documentation is not exactly clear about whether the input
or output device is meant, but the way I read it talks about
the output device as well (since encryption is only done at
output):

disable_xfrm - BOOLEAN

        Disable IPSEC encryption on this interface, whatever the policy

Opinions?


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 401 bytes --]

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 9f3924c..164a7ee 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1780,7 +1780,7 @@ #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
 #endif
 	if (in_dev->cnf.no_policy)
 		rth->u.dst.flags |= DST_NOPOLICY;
-	if (in_dev->cnf.no_xfrm)
+	if (out_dev->cnf.no_xfrm)
 		rth->u.dst.flags |= DST_NOXFRM;
 	rth->fl.fl4_dst	= daddr;
 	rth->rt_dst	= daddr;

Re: RFC: consistent disable_xfrm behaviour

[James Morris]

On Mon, 4 Dec 2006, Patrick McHardy wrote:

> disable_xfrm - BOOLEAN
> 
>         Disable IPSEC encryption on this interface, whatever the policy
> 
> Opinions?

Looks good to me, wonder what the original rationale was, though.



-- 
James Morris
<jmorris@namei.org>

Re: RFC: consistent disable_xfrm behaviour

[Patrick McHardy]

James Morris wrote:
> On Mon, 4 Dec 2006, Patrick McHardy wrote:
> 
> 
>>disable_xfrm - BOOLEAN
>>
>>        Disable IPSEC encryption on this interface, whatever the policy
>>
>>Opinions?
> 
> 
> Looks good to me, wonder what the original rationale was, though.

Me too. It was introduced by this patch:

http://linux.bkbits.net:8080/linux-2.6/cset@3dcb777f4YjzKm-lG0COu5u-oTLEWA?nav=index.html|src/|src/net|src/net/ipv4|related/net/ipv4/route.c

which only mentions the loopback device, in which case it
doesn't matter.

Alexey, do you remember what the original intent of this was?

Re: RFC: consistent disable_xfrm behaviour

[Alexey Kuznetsov]

Hello!

> Alexey, do you remember what the original intent of this was?

disable_policy was supposed to skip policy checks on input.
It makes sense only on input device.

disable_xfrm was supposed to skip transformations on output.
It makes sense only on output device.

If it does not work, it was done wrong. :-)

As I see it, root of the problem is that DST_NOXFRM flag
is calculated using wrong device. out_dev should be used
in __mkroute_input(). It looks as a cut-n-paste error, the code
was taken from output path, where it is correct.

Re: RFC: consistent disable_xfrm behaviour

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 694 bytes --]

Alexey Kuznetsov wrote:
> Hello!
> 
> 
>>Alexey, do you remember what the original intent of this was?
> 
> 
> disable_policy was supposed to skip policy checks on input.
> It makes sense only on input device.
> 
> disable_xfrm was supposed to skip transformations on output.
> It makes sense only on output device.
> 
> If it does not work, it was done wrong. :-)
> 
> As I see it, root of the problem is that DST_NOXFRM flag
> is calculated using wrong device. out_dev should be used
> in __mkroute_input(). It looks as a cut-n-paste error, the code
> was taken from output path, where it is correct.

Thanks, thats exactly what I suspected :)

Here's the patch again properly signed off.




[-- Attachment #2: x --]
[-- Type: text/plain, Size: 974 bytes --]

[XFRM]: Use output device disable_xfrm for forwarded packets

Currently the behaviour of disable_xfrm is inconsistent between
locally generated and forwarded packets. For locally generated
packets disable_xfrm disables the policy lookup if it is set on
the output device, for forwarded traffic however it looks at the
input device. This makes it impossible to disable xfrm on all
devices but a dummy device and use normal routing to direct
traffic to that device.

Always use the output device when checking disable_xfrm.

Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 9f3924c..164a7ee 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1780,7 +1780,7 @@ #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
 #endif
 	if (in_dev->cnf.no_policy)
 		rth->u.dst.flags |= DST_NOPOLICY;
-	if (in_dev->cnf.no_xfrm)
+	if (out_dev->cnf.no_xfrm)
 		rth->u.dst.flags |= DST_NOXFRM;
 	rth->fl.fl4_dst	= daddr;
 	rth->rt_dst	= daddr;

Re: RFC: consistent disable_xfrm behaviour

[Alexey Kuznetsov]

Hello!

> Here's the patch again properly signed off.

I think it is correct.

Alexey

Re: RFC: consistent disable_xfrm behaviour

[David Miller]

From: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Date: Mon, 4 Dec 2006 20:20:01 +0300

> > Here's the patch again properly signed off.
> 
> I think it is correct.

Patch applied, thanks everyone.

I'll push this one to -stable too.