Re: [RFC, PATCH 4/5]: netfilter+ipsec - policy lookup
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2004-03-19 11:51:30
Also in:
netfilter-devel
On Thu, Mar 18, 2004 at 05:32:23PM +0100, Patrick McHardy wrote:
quoted hunk ↗ jump to hunk
@@ -635,7 +636,6 @@ #ifdef CONFIG_IP_ROUTE_FWMARK fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark; #endif - fl.proto = iph->protocol;
Better call __ip_route_output_key rather than not setting proto because you'll need proto in xfrm_lookup.
if (ip_route_output_key(&rt, &fl) != 0) return -1;
quoted hunk ↗ jump to hunk
@@ -661,6 +661,20 @@ if ((*pskb)->dst->error) return -1; + +#ifdef CONFIG_XFRM + if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)) { + struct xfrm_policy_afinfo *afinfo; + + afinfo = xfrm_policy_get_afinfo(AF_INET); + if (afinfo != NULL) { + afinfo->decode_session(*pskb, &fl); + xfrm_policy_put_afinfo(afinfo); + if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0) != 0) + return -1; + } + } +#endif
If we can reinject transport packets then we can move this back into the if clause. -- Debian GNU/Linux 3.0 is out! ( http://www.debian.org/ ) Email: Herbert Xu ~{PmV>HI~} [off-list ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt