Skip to contentSkip to conversation

sctp: IPsec rules are ineffective with ipv6

PATCH In review Nicolas Dichtel 4 participants 7 messages Jan 27, 2010 – Jan 29, 2010

Subsystems (3)
Networking Network drivers SCTP protocol
lore
Share & tools
lore

Nicolas Dichtel

author
#0 lore raw

PATCH 1/1 sctp: IPsec rules are ineffective with ipv6

xfrm_lookup() is missing in sctp_v6_xmit(), add it.

Signed-off-by Junwei Zhang <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>
net/sctp/ipv6.c +5 -0
index cc50fbe..f24e23c 100644
@@ -197,8 +197,10 @@ out:
 static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 {
 	struct sock *sk = skb->sk;
+	struct dst_entry *dst = skb_dst(skb);
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct flowi fl;
+	int err;
 
 	memset(&fl, 0, sizeof(fl));
 

@@ -231,6 +233,9 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 	if (!(transport->param_flags & SPP_PMTUD_ENABLE))
 		skb->local_df = 1;
 
+	if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+		return err;
+
 	return ip6_xmit(sk, skb, &fl, np->opt, 0);
 }
#2 lore raw
Quoted 5 lines · David Miller

From: Nicolas Dichtel <[email protected]>
Date: Wed, 27 Jan 2010 15:12:59 +0100

Quoted 2 lines

xfrm_lookup() is missing in sctp_v6_xmit(), add it.

Quoted 8 lines
Quoted 2 lines
Signed-off-by Junwei Zhang <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>

Doing this every transmit packet is overkill.

Whatever calculates the route that ends up in skb_dst(skb) should be making this xfrm_lookup() call, not here.

Hmm.. Interesting. Looks like ip_route_output_key() will do xfrm_lookup for you, but there is no ipv6 route lookup call that will do the same thing.

I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().

-vlad

author
#3 lore raw

What about this one?

Only compilation tested.

xfrm_lookup() is missing in IPv6 output path. Call it when dst is build. Initial patch was written by Junwei Zhang <[email protected]>

Signed-off-by Nicolas Dichtel <[email protected]>
Quoted 16 lines · Vlad Yasevich
Quoted 12 lines · David Miller

From: Nicolas Dichtel <[email protected]>
Date: Wed, 27 Jan 2010 15:12:59 +0100

Quoted 4 lines

xfrm_lookup() is missing in sctp_v6_xmit(), add it.

Signed-off-by Junwei Zhang <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>

Doing this every transmit packet is overkill.

Whatever calculates the route that ends up in skb_dst(skb) should be making this xfrm_lookup() call, not here.

Quoted 7 lines

Hmm.. Interesting. Looks like ip_route_output_key() will do xfrm_lookup for you, but there is no ipv6 route lookup call that will do the same thing.

I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().

-vlad

net/sctp/ipv6.c +8 -7
index cc50fbe..4081ffb 100644
@@ -258,13 +258,14 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
 	}
 
 	dst = ip6_route_output(&init_net, NULL, &fl);
-	if (!dst->error) {
-		struct rt6_info *rt;
-		rt = (struct rt6_info *)dst;
-		SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
-			&rt->rt6i_dst.addr, &rt->rt6i_src.addr);
-		return dst;
-	}
+	if (!dst->error)
+		if (xfrm_lookup(&init_net, &dst, &fl, asoc ? asoc->base.sk : NULL, 0) >= 0) {
+			struct rt6_info *rt;
+			rt = (struct rt6_info *)dst;
+			SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
+				&rt->rt6i_dst.addr, &rt->rt6i_src.addr);
+			return dst;
+		}
 	SCTP_DEBUG_PRINTK("NO ROUTE\n");
 	dst_release(dst);
 	return NULL;
#4 lore raw
Quoted 8 lines · Nicolas Dichtel

What about this one?

Only compilation tested.

xfrm_lookup() is missing in IPv6 output path. Call it when dst is build. Initial patch was written by Junwei Zhang <[email protected]>

Signed-off-by Nicolas Dichtel <[email protected]>

Looks like it might do the right thing. Please run your tests on this an let me.

Thanks
-vlad

Quoted 25 lines · Vlad Yasevich
Quoted 23 lines
Quoted 12 lines · David Miller

From: Nicolas Dichtel <[email protected]>
Date: Wed, 27 Jan 2010 15:12:59 +0100

Quoted 4 lines

xfrm_lookup() is missing in sctp_v6_xmit(), add it.

Signed-off-by Junwei Zhang <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>

Doing this every transmit packet is overkill.

Whatever calculates the route that ends up in skb_dst(skb) should be making this xfrm_lookup() call, not here.

Hmm.. Interesting. Looks like ip_route_output_key() will do xfrm_lookup for you, but there is no ipv6 route lookup call that will do the same thing.

I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().

-vlad

author
#5 lore raw

Hmm, seems to not work.
Problem is that we may have a NULL saddr in sctp_v6_get_dst().
What about adding a new handler in struct sctp_af, like get_xfrm_dst() that will be called after get_saddr()? In case of IPv4, it will not do anything.

Regards,
Nicolas

Quoted 41 lines · Vlad Yasevich
Quoted 8 lines · Nicolas Dichtel

What about this one?

Only compilation tested.

xfrm_lookup() is missing in IPv6 output path. Call it when dst is build. Initial patch was written by Junwei Zhang <[email protected]>

Signed-off-by Nicolas Dichtel <[email protected]>

Looks like it might do the right thing. Please run your tests on this an let me.

Thanks
-vlad

Quoted 22 lines · Vlad Yasevich
Quoted 21 lines
Quoted 12 lines · David Miller

From: Nicolas Dichtel <[email protected]>
Date: Wed, 27 Jan 2010 15:12:59 +0100

Quoted 4 lines

xfrm_lookup() is missing in sctp_v6_xmit(), add it.

Signed-off-by Junwei Zhang <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>

Doing this every transmit packet is overkill.

Whatever calculates the route that ends up in skb_dst(skb) should be making this xfrm_lookup() call, not here.

Hmm.. Interesting. Looks like ip_route_output_key() will do xfrm_lookup for you, but there is no ipv6 route lookup call that will do the same thing.

I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().

-vlad

#6 lore raw
Quoted 5 lines · Nicolas Dichtel

Hmm, seems to not work.
Problem is that we may have a NULL saddr in sctp_v6_get_dst(). What about adding a new handler in struct sctp_af, like get_xfrm_dst() that will be called after get_saddr()? In case of IPv4, it will not do anything.

This would work for transmit SCTP packet under IPSEC, the problem is that we can not get the correct PMTU for the transport.Under IPv4, both transmit and the PMTU is correct.

Quoted 54 lines

Regards,
Nicolas

Quoted 42 lines · Vlad Yasevich
Quoted 9 lines · Nicolas Dichtel

What about this one?

Only compilation tested.

xfrm_lookup() is missing in IPv6 output path. Call it when dst is build.
Initial patch was written by Junwei Zhang <[email protected]>

Signed-off-by Nicolas Dichtel <[email protected]>

Looks like it might do the right thing. Please run your tests on this an let me.

Thanks
-vlad

Quoted 22 lines · Vlad Yasevich
Quoted 21 lines
Quoted 12 lines · David Miller

From: Nicolas Dichtel <[email protected]>
Date: Wed, 27 Jan 2010 15:12:59 +0100

Quoted 4 lines

xfrm_lookup() is missing in sctp_v6_xmit(), add it.

Signed-off-by Junwei Zhang <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>

Doing this every transmit packet is overkill.

Whatever calculates the route that ends up in skb_dst(skb) should be making this xfrm_lookup() call, not here.

Hmm.. Interesting. Looks like ip_route_output_key() will do xfrm_lookup for you, but there is no ipv6 route lookup call that will do the same thing.

I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().

-vlad

Signature · 3 lines
To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html