| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 24 Aug 2007 23:33:13 -0700 (PDT) From: David Miller <davem@...emloft.net> To: nakam@...ux-ipv6.org Cc: netdev@...r.kernel.org Subject: Re: [PATCH 2/2] [IPV4] IPSEC: Omit redirect for tunnelled packet. From: Masahide NAKAMURA <nakam@...ux-ipv6.org> Date: Fri, 24 Aug 2007 19:09:01 +0900 > IPv4 IPsec tunnel gateway incorrectly sends redirect to > sender if it is onlink host when network device the IPsec tunnelled > packet is arrived is the same as the one the decapsulated packet > is sent. > > With this patch, it omits to send the redirect when the forwarding > skbuff carries secpath, since such skbuff should be assumed as > a decapsulated packet from IPsec tunnel by own. > > Request for comments: > Alternatively we'd have another way to change net/ipv4/route.c > (__mkroute_input) to use RTCF_DOREDIRECT flag unless skbuff > has no secpath. It is better than this patch at performance > point of view because IPv4 redirect judgement is done at > routing slow-path. However, it should be taken care of resource > changes between SAD(XFRM states) and routing table. In other words, > When IPv4 SAD is changed does the related routing entry go to its > slow-path? If not, it is reasonable to apply this patch. > > Signed-off-by: Masahide NAKAMURA <nakam@...ux-ipv6.org> Also applied, thank you! - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists