| Message ID | 4aeb83c2-bd0d-8a11-39e0-18d3b7cd12ca@strongswan.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net-next] ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT | expand |
On Thu, Dec 21, 2017 at 05:32:24PM +0100, Tobias Brunner wrote: > If SNAT modifies the source address the resulting packet might match > an IPsec policy, reinject the packet if that's the case. > > The exact same thing is already done for IPv4. Right, this was forgotten when IPv6 got NAT support. Acked-by: Steffen Klassert <steffen.klassert@secunet.com> Thanks!
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 176d74fb3b4d..c90f02632782 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -138,6 +138,14 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s return ret; } +#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) + /* Policy lookup after SNAT yielded a new policy */ + if (skb_dst(skb)->xfrm) { + IPCB(skb)->flags |= IPSKB_REROUTED; + return dst_output(net, sk, skb); + } +#endif + if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) || dst_allfrag(skb_dst(skb)) || (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
If SNAT modifies the source address the resulting packet might match an IPsec policy, reinject the packet if that's the case. The exact same thing is already done for IPv4. Signed-off-by: Tobias Brunner <tobias@strongswan.org> --- net/ipv6/ip6_output.c | 8 ++++++++ 1 file changed, 8 insertions(+)