diff mbox

IPsec tunnel forwarding in net-next-2.6 since 452edd59

Message ID 1300227411.2565.7.camel@edumazet-laptop
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Eric Dumazet March 15, 2011, 10:16 p.m. UTC 
Le mardi 15 mars 2011 à 14:30 -0400, Michael Smith a écrit :
> Hi,
> 
> I'm able to ping across a tunnel to a peer running net-next-2.6, but 
> only to an interface on the peer; trying to ping a host behind the peer 
> fails. The incoming packet shows up in encrypted and decrypted form in 
> tcpdump, but it's not forwarded. None of the XFRM error counters are 
> incremented; the packets just silently fail to be forwarded.
> 
> There are no iptables rules and net.ipv4.ip_forward=1. The same config 
> works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2:
> 
>      xfrm: Return dst directly from xfrm_lookup()
> 
>      Instead of on the stack.
> 
> 
> ip xfrm policy:
> 
> src 192.168.136.0/24 dst 192.168.137.0/24
>          dir out priority 2344 ptype main
>          tmpl src 1.1.1.136 dst 1.1.1.137
>                  proto esp reqid 16385 mode tunnel
> 
> src 192.168.137.0/24 dst 192.168.136.0/24
>          dir fwd priority 2344 ptype main
>          tmpl src 1.1.1.137 dst 1.1.1.136
>                  proto esp reqid 16385 mode tunnel
> 
> src 192.168.137.0/24 dst 192.168.136.0/24
>          dir in priority 2344 ptype main
>          tmpl src 1.1.1.137 dst 1.1.1.136
>                  proto esp reqid 16385 mode tunnel
> 
> net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is 
> at 1.1.1.137 and 192.168.137.1. From that host:
> 
> ping -I 192.168.137.1 192.168.136.1 -> success
> ping -I 192.168.137.1 192.168.136.2 -> silent failure
> 
> Thanks,

Thanks for this excellent bug report !

Could you try following patch ?

[PATCH] xfrm: fix __xfrm_route_forward()

This function should return 0 in case of error, 1 if OK
commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup())
got it wrong.

Reported-and-bisected-by: Michael Smith <msmith@cbnco.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Miller March 15, 2011, 10:28 p.m. UTC | #1 
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 15 Mar 2011 23:16:51 +0100

> Could you try following patch ?
> 
> [PATCH] xfrm: fix __xfrm_route_forward()
> 
> This function should return 0 in case of error, 1 if OK
> commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup())
> got it wrong.
> 
> Reported-and-bisected-by: Michael Smith <msmith@cbnco.com>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

Thanks so much for fixing this Eric, sheesh you are so awesome that
you don't even give me enough time to fix my own bugs. :-))))

Applied, and indeed thanks to Michael for the excellent report.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Eric Dumazet March 15, 2011, 10:31 p.m. UTC | #2 
Le mardi 15 mars 2011 à 15:28 -0700, David Miller a écrit :

> Thanks so much for fixing this Eric, sheesh you are so awesome that
> you don't even give me enough time to fix my own bugs. :-))))
> 

Well, I know you must be pretty busy now linux-2.6.38 is released ;)

> Applied, and indeed thanks to Michael for the excellent report.
> 


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Michael Smith March 15, 2011, 10:51 p.m. UTC | #3 
On Tue, 15 Mar 2011, Eric Dumazet wrote:

> Could you try following patch ?
> 
> [PATCH] xfrm: fix __xfrm_route_forward()
> 
> This function should return 0 in case of error, 1 if OK
> commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup())
> got it wrong.

That does the trick, thanks! Nice catch.

Mike
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 1ba0258..027e3c6 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2175,7 +2175,7 @@  int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 	struct net *net = dev_net(skb->dev);
 	struct flowi fl;
 	struct dst_entry *dst;
-	int res = 0;
+	int res = 1;
 
 	if (xfrm_decode_session(skb, &fl, family) < 0) {
 		XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
@@ -2186,7 +2186,7 @@  int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 
 	dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, 0);
 	if (IS_ERR(dst)) {
-		res = 1;
+		res = 0;
 		dst = NULL;
 	}
 	skb_dst_set(skb, dst);