From patchwork Tue Mar 15 22:16:51 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 87101 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 929AAB7252 for ; Wed, 16 Mar 2011 09:17:08 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751507Ab1COWRD (ORCPT ); Tue, 15 Mar 2011 18:17:03 -0400 Received: from mail-bw0-f46.google.com ([209.85.214.46]:52354 "EHLO mail-bw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750863Ab1COWRB (ORCPT ); Tue, 15 Mar 2011 18:17:01 -0400 Received: by bwz15 with SMTP id 15so1021709bwz.19 for ; Tue, 15 Mar 2011 15:17:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:subject:from:to:cc:in-reply-to:references :content-type:date:message-id:mime-version:x-mailer :content-transfer-encoding; bh=cy2sX5mWiQqx7D6UBMDe4FxS8sN/lGxHPSeQuPT4Avc=; b=K3mZSICBK030xoN/ybpdBeSPO8TySrz/Y2UWq9RD1zM+WRMyl9V0lX8PbI43riUQEg FS8ZBuvZE8xQnCGTGvUL4kkOWxON7c4vwJ6TDXAaNalpNt66vbAe2HISQ3VGqFtPecZf LYQXRBBnUaXby6rZLaF54I3QiCG+U0EC98dK8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; b=DHxTXEsT9Tg3rL9K+Uemn0FzDhHi0aLzXghlg+U+olQCu4zYuF+3r++A8BqHw41QtY sLrwZwIrIy3JNLsYzkx7uuOznfo3GXaUdSd9hZmqPS0lkAOd0EF0OWlLPlDYxbGbNRRi t/a6FFdZXx5kEYJrdlEQUL2gzIp4I7al2W21o= Received: by 10.204.82.74 with SMTP id a10mr54659bkl.96.1300227420065; Tue, 15 Mar 2011 15:17:00 -0700 (PDT) Received: from [192.168.1.21] (167.237.66-86.rev.gaoland.net [86.66.237.167]) by mx.google.com with ESMTPS id l1sm213660bkl.1.2011.03.15.15.16.57 (version=SSLv3 cipher=OTHER); Tue, 15 Mar 2011 15:16:58 -0700 (PDT) Subject: Re: IPsec tunnel forwarding in net-next-2.6 since 452edd59 From: Eric Dumazet To: Michael Smith Cc: netdev@vger.kernel.org, David Miller In-Reply-To: <4D7FB054.2090902@cbnco.com> References: <4D7FB054.2090902@cbnco.com> Date: Tue, 15 Mar 2011 23:16:51 +0100 Message-ID: <1300227411.2565.7.camel@edumazet-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Le mardi 15 mars 2011 à 14:30 -0400, Michael Smith a écrit : > Hi, > > I'm able to ping across a tunnel to a peer running net-next-2.6, but > only to an interface on the peer; trying to ping a host behind the peer > fails. The incoming packet shows up in encrypted and decrypted form in > tcpdump, but it's not forwarded. None of the XFRM error counters are > incremented; the packets just silently fail to be forwarded. > > There are no iptables rules and net.ipv4.ip_forward=1. The same config > works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2: > > xfrm: Return dst directly from xfrm_lookup() > > Instead of on the stack. > > > ip xfrm policy: > > src 192.168.136.0/24 dst 192.168.137.0/24 > dir out priority 2344 ptype main > tmpl src 1.1.1.136 dst 1.1.1.137 > proto esp reqid 16385 mode tunnel > > src 192.168.137.0/24 dst 192.168.136.0/24 > dir fwd priority 2344 ptype main > tmpl src 1.1.1.137 dst 1.1.1.136 > proto esp reqid 16385 mode tunnel > > src 192.168.137.0/24 dst 192.168.136.0/24 > dir in priority 2344 ptype main > tmpl src 1.1.1.137 dst 1.1.1.136 > proto esp reqid 16385 mode tunnel > > net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is > at 1.1.1.137 and 192.168.137.1. From that host: > > ping -I 192.168.137.1 192.168.136.1 -> success > ping -I 192.168.137.1 192.168.136.2 -> silent failure > > Thanks, Thanks for this excellent bug report ! Could you try following patch ? [PATCH] xfrm: fix __xfrm_route_forward() This function should return 0 in case of error, 1 if OK commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup()) got it wrong. Reported-and-bisected-by: Michael Smith Signed-off-by: Eric Dumazet --- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 1ba0258..027e3c6 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2175,7 +2175,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) struct net *net = dev_net(skb->dev); struct flowi fl; struct dst_entry *dst; - int res = 0; + int res = 1; if (xfrm_decode_session(skb, &fl, family) < 0) { XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR); @@ -2186,7 +2186,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, 0); if (IS_ERR(dst)) { - res = 1; + res = 0; dst = NULL; } skb_dst_set(skb, dst);