q3k
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/net/ipv4
History
Patrick McHardy ee68cea2c2 [NETFILTER]: Fix xfrm lookup after SNAT 
To find out if a packet needs to be handled by IPsec after SNAT, packets
are currently rerouted in POST_ROUTING and a new xfrm lookup is done. This
breaks SNAT of non-unicast packets to non-local addresses because the
packet is routed as incoming packet and no neighbour entry is bound to the
dst_entry. In general, it seems to be a bad idea to replace the dst_entry
after the packet was already sent to the output routine because its state
might not match what's expected.

This patch changes the xfrm lookup in POST_ROUTING to re-use the original
dst_entry without routing the packet again. This means no policy routing
can be used for transport mode transforms (which keep the original route)
when packets are SNATed to match the policy, but it looks like the best
we can do for now.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2006-02-15 01:34:23 -08:00
..
ipvs [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
netfilter [NETFILTER]: Fix xfrm lookup after SNAT 2006-02-15 01:34:23 -08:00
Kconfig [TCP] BIC: CUBIC window growth (2.0) 2006-01-03 13:10:28 -08:00
Makefile [NETFILTER]: net/ipv[46]/netfilter.c cleanups 2006-01-10 12:54:29 -08:00
af_inet.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
ah4.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
arp.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
datagram.c [NET]: Fix sparse warnings 2005-08-29 16:01:32 -07:00
devinet.c [NETLINK]: illegal use of pid in rtnetlink 2006-02-09 16:43:41 -08:00
esp4.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
fib_frontend.c x86: Work around compiler code generation bug with -Os 2006-01-14 22:08:28 -08:00
fib_hash.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
fib_lookup.h [IPV4]: Prepare FIB core for RCU. 2005-08-29 16:08:31 -07:00
fib_rules.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
fib_semantics.c [NETLINK]: illegal use of pid in rtnetlink 2006-02-09 16:43:41 -08:00
fib_trie.c [IPV4] fib_trie: build fix 2006-01-03 14:38:34 -08:00
icmp.c [IPV4] ICMP: Invert default for invalid icmp msgs sysctl 2006-02-13 15:36:21 -08:00
igmp.c [PATCH] ipv4 NULL noise removal 2006-02-07 20:57:37 -05:00
inet_connection_sock.c [ICSK]: Move v4_addr2sockaddr from TCP to icsk 2006-01-03 13:10:39 -08:00
inet_diag.c [INET_DIAG]: Introduce sk_diag_fill 2006-01-09 14:56:56 -08:00
inet_hashtables.c [INET]: Generalise tcp_v4_hash_connect 2006-01-03 13:10:55 -08:00
inet_timewait_sock.c [TWSK]: Introduce struct timewait_sock_ops 2006-01-03 13:10:54 -08:00
inetpeer.c [NET]: Change some "if (x) BUG();" to "BUG_ON(x);" 2006-01-09 14:16:18 -08:00
ip_forward.c [IPV4]: Remove some dead code from ip_forward() 2005-08-29 16:03:06 -07:00
ip_fragment.c [NET]: Endian-annotate struct iphdr 2006-01-06 13:24:29 -08:00
ip_gre.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
ip_input.c [NETFILTER]: Keep conntrack reference until IPsec policy checks are done 2006-01-07 12:57:36 -08:00
ip_options.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
ip_output.c [IPV4]: ip_output.c needs xfrm.h 2006-01-09 14:16:28 -08:00
ip_sockglue.c [NET]: Remove more unneeded typecasts on *malloc() 2006-01-11 16:32:14 -08:00
ipcomp.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
ipconfig.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
ipip.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
ipmr.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
multipath.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
multipath_drr.c [IPV4]: possible cleanups 2005-08-29 15:33:20 -07:00
multipath_random.c [IPV4]: Multipath modules need a license to prevent kernel tainting. 2005-06-13 14:29:06 -07:00
multipath_rr.c [IPV4]: Multipath modules need a license to prevent kernel tainting. 2005-06-13 14:29:06 -07:00
multipath_wrandom.c [IPV4] multipath_wrandom: Fix softirq-unsafe spin lock usage 2006-02-02 16:59:16 -08:00
netfilter.c [NETFILTER]: Fix xfrm lookup after SNAT 2006-02-15 01:34:23 -08:00
proc.c [PATCH] percpu data: only iterate over possible CPUs 2006-02-05 11:06:51 -08:00
protocol.c [TCP]: Move the tcp sock states to net/tcp_states.h 2005-08-29 15:41:54 -07:00
raw.c [PATCH] EDAC: atomic scrub operations 2006-01-18 19:20:30 -08:00
route.c [IPV4]: RT_CACHE_STAT_INC() warning fix 2006-01-17 22:46:49 -08:00
syncookies.c [ICSK]: Rename struct tcp_func to struct inet_connection_sock_af_ops 2006-01-03 13:10:38 -08:00
sysctl_net_ipv4.c [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
tcp.c [IP_SOCKGLUE]: Remove most of the tcp specific calls 2006-01-03 13:10:58 -08:00
tcp_bic.c [TCP] BIC: spelling and whitespace 2006-01-03 13:10:27 -08:00
tcp_cong.c [TCP]: less inline's 2006-01-03 16:03:49 -08:00
tcp_cubic.c [TCP] cubic: use Newton-Raphson 2006-01-03 13:11:09 -08:00
tcp_diag.c [INET_DIAG]: Move the tcp_diag interface to the proper place 2005-08-29 15:57:54 -07:00
tcp_highspeed.c [TCP]: TCP highspeed build error 2005-11-17 14:11:18 -08:00
tcp_htcp.c [TCP] H-TCP: Fix accounting 2006-01-30 20:54:39 -08:00
tcp_hybla.c [TCP]: fix congestion window update when using TSO deferal 2005-11-10 16:53:30 -08:00
tcp_input.c [TCP]: rcvbuf lock when tcp_moderate_rcvbuf enabled 2006-02-09 17:06:57 -08:00
tcp_ipv4.c [NET]: Do not export inet_bind_bucket_create twice. 2006-01-31 17:47:02 -08:00
tcp_minisocks.c [IPV6]: Introduce inet6_timewait_sock 2006-01-03 13:10:47 -08:00
tcp_output.c [TCP]: less inline's 2006-01-03 16:03:49 -08:00
tcp_scalable.c [TCP]: add tcp_slow_start helper 2005-11-10 17:07:24 -08:00
tcp_timer.c [TCP]: spelling fixes 2005-11-10 17:13:47 -08:00
tcp_vegas.c [TCP] tcp_vegas: Fix slow start 2006-01-04 13:59:32 -08:00
tcp_westwood.c [INET_DIAG]: Rename tcp_diag.[ch] to inet_diag.[ch] 2005-08-29 15:57:48 -07:00
udp.c [NETFILTER]: Keep conntrack reference until IPsec policy checks are done 2006-01-07 12:57:36 -08:00
xfrm4_input.c [IPV4/6]: Netfilter IPsec input hooks 2006-01-07 12:57:31 -08:00
xfrm4_output.c [NETFILTER]: Redo policy lookups after NAT when neccessary 2006-01-07 12:57:35 -08:00
xfrm4_policy.c [PATCH] remove bogus asm/bug.h includes. 2006-02-07 20:56:35 -05:00
xfrm4_state.c [XFRM]: IPsec tunnel wildcard address support 2006-01-13 14:34:36 -08:00
xfrm4_tunnel.c [NET]: Make ipip/ip6_tunnel independant of XFRM 2005-07-19 14:03:34 -07:00