From: Herbert Xu <herbert@gondor.apana.org.au> Date: 2004-11-23 08:42:25
Hi:
I found out today that packets generated by ipt_REJECT weren't protected
by IPsec. This is because the proto field isn't set at all in the flow
supplied to ip_route_output_key.
The following patch sets that as well as protocol-specific fields so
that the appropriate IPsec policy can be applied.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
From: Harald Welte <hidden> Date: 2004-11-23 09:22:30
On Tue, Nov 23, 2004 at 07:42:25PM +1100, Herbert Xu wrote:
Hi:
I found out today that packets generated by ipt_REJECT weren't protected
by IPsec. This is because the proto field isn't set at all in the flow
supplied to ip_route_output_key.
I see. I guess REJECT is actually longer in the kernel than the IPsec
code, so nobody with a thorough understanding of both pieces of code did
notice that it needs to change.
The following patch sets that as well as protocol-specific fields so
that the appropriate IPsec policy can be applied.
The patch looks fine to me. Dave: Please apply at your convenience.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Harald Welte <redacted>
(in case this is needed)
Cheers,
--
- Harald Welte [off-list ref] http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
From: Patrick McHardy <hidden> Date: 2004-11-23 18:17:36
Herbert Xu wrote:
Hi:
I found out today that packets generated by ipt_REJECT weren't protected
by IPsec. This is because the proto field isn't set at all in the flow
supplied to ip_route_output_key.
The following patch sets that as well as protocol-specific fields so
that the appropriate IPsec policy can be applied.
The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.
Regards
Patrick
From: Patrick McHardy <hidden> Date: 2004-11-23 21:44:33
Herbert Xu wrote:
On Tue, Nov 23, 2004 at 07:17:36PM +0100, Patrick McHardy wrote:
quoted
The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.
Isn't that handled by ip_forward itself?
No. ip_forward handles the original packet, not the packet generated
by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
ip_route_input because they have a non-local source, so xfrm_route_forward
or xfrm_lookup needs to be called for them.
Regards
Patrick
From: Herbert Xu <herbert@gondor.apana.org.au> Date: 2004-11-23 22:19:01
On Tue, Nov 23, 2004 at 10:44:33PM +0100, Patrick McHardy wrote:
No. ip_forward handles the original packet, not the packet generated
by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
ip_route_input because they have a non-local source, so xfrm_route_forward
or xfrm_lookup needs to be called for them.