Re: [PATCH 2/2] Interfamily IPSec BEET
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2008-08-04 16:20:50
On Mon, Aug 04, 2008 at 04:19:42PM +0300, Joakim Koskela wrote:
This fixes the ipv4-inner, ipv6-outer mode. This one is a bit more complex as not only do we need to take into account the difference between ipv4/ipv6 headers when adjusting the sk_buff network header, we also need to reserve extra room for the new ipv6 header. This extra room, here got by adding it to the props.header_len, is needed to accomodate the new & larger ipv6 header (the kernel is currently panicing because of this). The BEET ipv4 pseudo-header construction was also missing from the ipv6 output. Signed-off-by: Joakim Koskela <redacted>
Thanks for tracking this down Joakim! I'm sorry for not spending any time on this earlier.
quoted hunk ↗ jump to hunk
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index c6bb4c6..f09fcb9 100644 --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c@@ -521,6 +521,10 @@ static int esp6_init_state(struct xfrm_state *x) crypto_aead_ivsize(aead); switch (x->props.mode) { case XFRM_MODE_BEET: + x->props.header_len += IPV4_BEET_PHMAXLEN; + if (x->sel.family == AF_INET) + x->props.header_len += (sizeof(struct ipv6hdr) - sizeof(struct iphdr));
This is still going to break with the new any family (i.e., v4 or v6) SA. So perhaps that should be x->sel.family != AF_INET6. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} [off-list ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt