netdev - Re: [PATCH 2/2] [IPV4] IPSEC: Omit redirect for tunnelled packet.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20070824.233313.34382404.davem@davemloft.net>
Date:	Fri, 24 Aug 2007 23:33:13 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	nakam@...ux-ipv6.org
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH 2/2] [IPV4] IPSEC: Omit redirect for tunnelled packet.

From: Masahide NAKAMURA <nakam@...ux-ipv6.org>
Date: Fri, 24 Aug 2007 19:09:01 +0900

> IPv4 IPsec tunnel gateway incorrectly sends redirect to
> sender if it is onlink host when network device the IPsec tunnelled
> packet is arrived is the same as the one the decapsulated packet
> is sent.
> 
> With this patch, it omits to send the redirect when the forwarding
> skbuff carries secpath, since such skbuff should be assumed as
> a decapsulated packet from IPsec tunnel by own.
> 
> Request for comments:
> Alternatively we'd have another way to change net/ipv4/route.c
> (__mkroute_input) to use RTCF_DOREDIRECT flag unless skbuff
> has no secpath. It is better than this patch at performance
> point of view because IPv4 redirect judgement is done at
> routing slow-path. However, it should be taken care of resource
> changes between SAD(XFRM states) and routing table. In other words,
> When IPv4 SAD is changed does the related routing entry go to its
> slow-path? If not, it is reasonable to apply this patch.
> 
> Signed-off-by: Masahide NAKAMURA <nakam@...ux-ipv6.org>

Also applied, thank you!
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html