Skip to contentSkip to conversation

xfrm: fix xfrm by MARK logic

PATCH Applied Peter Kosyh 4 participants 4 messages Jul 2, 2010 – Jul 4, 2010

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Peter Kosyh

author
#0 lore raw

PATCH v2 1/1 xfrm: fix xfrm by MARK logic

From: Peter Kosyh <[email protected]>

While using xfrm by MARK feature in
2.6.34 - 2.6.35 kernels, the mark
is always cleared in flowi structure via memset in _decode_session4 (net/ipv4/xfrm4_policy.c), so the policy lookup fails.
IPv6 code is affected by this bug too.

Signed-off-by Peter Kosyh <[email protected]>

---

net/ipv4/xfrm4_policy.c +2 -0
diff -uprN linux-2.6.35-rc3.orig/net/ipv4/xfrm4_policy.c linux-2.6.35-rc3/net/ipv4/xfrm4_policy.c
@@ -108,6 +108,8 @@ _decode_session4(struct sk_buff *skb, st
 	u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
 
 	memset(fl, 0, sizeof(struct flowi));
+	fl->mark = skb->mark;
+
 	if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
 		switch (iph->protocol) {
 		case IPPROTO_UDP:
net/ipv6/xfrm6_policy.c +2 -0
diff -uprN linux-2.6.35-rc3.orig/net/ipv6/xfrm6_policy.c linux-2.6.35-rc3/net/ipv6/xfrm6_policy.c
@@ -124,6 +124,8 @@ _decode_session6(struct sk_buff *skb, st
 	u8 nexthdr = nh[IP6CB(skb)->nhoff];
 
 	memset(fl, 0, sizeof(struct flowi));
+	fl->mark = skb->mark;
+
 	ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
 	ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
#2 lore raw

Great,

this was the second bug [besides the xfrm_mark_get issue] I was looking for this week and which prevented strongSwan from successfully using mark-based IPsec policies. It works like a charm now.

Thanks!

Quoted 17 lines · Eric Dumazet
Quoted 9 lines · Peter Kosyh

From: Peter Kosyh <[email protected]>

While using xfrm by MARK feature in
2.6.34 - 2.6.35 kernels, the mark
is always cleared in flowi structure via memset in _decode_session4 (net/ipv4/xfrm4_policy.c), so the policy lookup fails.
IPv6 code is affected by this bug too.

Quoted 3 lines
Signed-off-by Peter Kosyh <[email protected]>

---

Acked-by Eric Dumazet <[email protected]>

Thanks !

Signature · 7 lines
======================================================================
Andreas Steffen                         [email protected]
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==
maintainer Applied
#3 lore raw
In reply to Eric Dumazet

From: Eric Dumazet <[email protected]>
Date: Sat, 03 Jul 2010 08:38:03 +0200

Quoted 10 lines · Peter Kosyh
Quoted 9 lines

From: Peter Kosyh <[email protected]>

While using xfrm by MARK feature in
2.6.34 - 2.6.35 kernels, the mark
is always cleared in flowi structure via memset in _decode_session4 (net/ipv4/xfrm4_policy.c), so the policy lookup fails.
IPv6 code is affected by this bug too.

Quoted 5 lines
Quoted 3 lines
Signed-off-by Peter Kosyh <[email protected]>

---

Acked-by Eric Dumazet <[email protected]>

Applied, thanks everyone.