Commit 09ee9dba authored by Tobias Brunner's avatar Tobias Brunner Committed by David S. Miller
Browse files

ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT 



If SNAT modifies the source address the resulting packet might match
an IPsec policy, reinject the packet if that's the case.

The exact same thing is already done for IPv4.

Signed-off-by: default avatarTobias Brunner <tobias@strongswan.org>
Acked-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 18feb871

net/ipv6/ip6_output.c

+8 −0
Original line number Diff line number Diff line
@@ -138,6 +138,14 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s 
		return ret;

	}



#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)

	/* Policy lookup after SNAT yielded a new policy */

	if (skb_dst(skb)->xfrm) {

		IPCB(skb)->flags |= IPSKB_REROUTED;

		return dst_output(net, sk, skb);

	}

#endif



	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||

	    dst_allfrag(skb_dst(skb)) ||

	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))

CRA Git | Maintained and supported by SUSTech CRA and CCSE