Subject: Re: [PATCH] sctp: IPsec rules are ineffective with ipv6

From: Wei Yongjun <[email-masked]>
Date: Fri, 29 Jan 2010 10:03:03 +0800

Nicolas Dichtel wrote:
> Hmm, seems to not work.
> Problem is that we may have a NULL saddr in sctp_v6_get_dst().
> What about adding a new handler in struct sctp_af, like get_xfrm_dst()
> that will be called after get_saddr()? In case of IPv4, it will not do
> anything.

This would work for transmit SCTP packet under IPSEC, the
problem is that we can not get the correct PMTU for the
transport.Under IPv4, both transmit and the PMTU is correct.

>
>
> Regards,
> Nicolas
>
> Le 28.01.2010 17:36, Vlad Yasevich a écrit :
>>
>> Nicolas Dichtel wrote:
>>> What about this one?
>>>
>>> Only compilation tested.
>>>
>>> xfrm_lookup() is missing in IPv6 output path. Call it when dst is
>>> build.
>>> Initial patch was written by Junwei Zhang <[email-masked]>
>>>
>>> Signed-off-by: Nicolas Dichtel <[email-masked]>
>>
>> Looks like it might do the right thing.  Please run your tests
>> on this an let me.
>>
>> Thanks
>> -vlad
>>
>>> Le 28.01.2010 16:24, Vlad Yasevich a écrit :
>>>> David Miller wrote:
>>>>> From: Nicolas Dichtel <[email-masked]>
>>>>> Date: Wed, 27 Jan 2010 15:12:59 +0100
>>>>>
>>>>>> xfrm_lookup() is missing in sctp_v6_xmit(), add it.
>>>>>>
>>>>>> Signed-off-by: Junwei Zhang <[email-masked]>
>>>>>> Signed-off-by: Nicolas Dichtel <[email-masked]>
>>>>> Doing this every transmit packet is overkill.
>>>>>
>>>>> Whatever calculates the route that ends up in skb_dst(skb)
>>>>> should be making this xfrm_lookup() call, not here.
>>>>>
>>>>
>>>> Hmm.. Interesting.  Looks like ip_route_output_key() will
>>>> do xfrm_lookup for you, but there is no ipv6 route lookup call
>>>> that will do the same thing.
>>>>
>>>> I guess we'll need to add an xfrm_lookup call in sctp_v6_get_dst().
>>>>
>>>> -vlad
>>
>>
> -- 
> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> the body of a message to [email-masked]
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>