[PATCH] ipv6: do xfrm transform after nat if necessary

[PATCH] ipv6: do xfrm transform after nat if necessary

[Duan Jiong]

In function nf_nat_ipv6_out, after nat is done, nf_xfrm_me_harder()
will be called to look up xfrm dst.

Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>
---
 net/ipv6/ip6_output.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 8e950c2..742a845 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -124,6 +124,14 @@ static int ip6_finish_output2(struct sk_buff *skb)
 
 static int ip6_finish_output(struct sk_buff *skb)
 {
+#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
+	/* Just like ipv4, policy lookup after nat yielded a new policy */
+	if (skb_dst(skb)->xfrm != NULL) {
+		IP6CB(skb)->flags |= IP6SKB_REROUTED;
+		return dst_output(skb);
+	}
+#endif
+
 	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
 	    dst_allfrag(skb_dst(skb)) ||
 	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
-- 
1.8.3.1

Re: [PATCH] ipv6: do xfrm transform after nat if necessary

[David Miller]

From: Duan Jiong <duanj.fnst@cn.fujitsu.com>
Date: Mon, 3 Nov 2014 12:53:03 +0800

> 
> 
> In function nf_nat_ipv6_out, after nat is done, nf_xfrm_me_harder()
> will be called to look up xfrm dst.
> 
> Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>

This is far from sufficient of a commit log message for a change that
is as serious and has as many implications as this one.

You haven't answered many questions, first of which in my mind is
why we are bypassing all of the fragmentation checks?

We're also bypassing ip6_finish_output2() which does multicast and
hooks up the neighbour.

IPV4 doesn't do this, why doesn't it have the same supposed problem
you are trying to solve?

It is not even clear to me what the problem is, because your commit
message is way too terse.

Re: [PATCH] ipv6: do xfrm transform after nat if necessary

[Duan Jiong]

On 11/04/2014 03:42 AM, David Miller wrote:
> From: Duan Jiong <duanj.fnst@cn.fujitsu.com>
> Date: Mon, 3 Nov 2014 12:53:03 +0800
> 
>>
>>
>> In function nf_nat_ipv6_out, after nat is done, nf_xfrm_me_harder()
>> will be called to look up xfrm dst.
>>
>> Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>
> 
> This is far from sufficient of a commit log message for a change that
> is as serious and has as many implications as this one.
> 
> You haven't answered many questions, first of which in my mind is
> why we are bypassing all of the fragmentation checks?
> 
> We're also bypassing ip6_finish_output2() which does multicast and
> hooks up the neighbour.
> 
> IPV4 doesn't do this, why doesn't it have the same supposed problem
> you are trying to solve?
> 
> It is not even clear to me what the problem is, because your commit
> message is way too terse.
> 
Thank you for your advice, I would consider a more comprehensive 
of the problem.

Thanks,
  Duan