* IPsec tunnel forwarding in net-next-2.6 since 452edd59
@ 2011-03-15 18:30 Michael Smith
2011-03-15 22:16 ` Eric Dumazet
0 siblings, 1 reply; 5+ messages in thread
From: Michael Smith @ 2011-03-15 18:30 UTC (permalink / raw)
To: netdev
Hi,
I'm able to ping across a tunnel to a peer running net-next-2.6, but
only to an interface on the peer; trying to ping a host behind the peer
fails. The incoming packet shows up in encrypted and decrypted form in
tcpdump, but it's not forwarded. None of the XFRM error counters are
incremented; the packets just silently fail to be forwarded.
There are no iptables rules and net.ipv4.ip_forward=1. The same config
works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2:
xfrm: Return dst directly from xfrm_lookup()
Instead of on the stack.
ip xfrm policy:
src 192.168.136.0/24 dst 192.168.137.0/24
dir out priority 2344 ptype main
tmpl src 1.1.1.136 dst 1.1.1.137
proto esp reqid 16385 mode tunnel
src 192.168.137.0/24 dst 192.168.136.0/24
dir fwd priority 2344 ptype main
tmpl src 1.1.1.137 dst 1.1.1.136
proto esp reqid 16385 mode tunnel
src 192.168.137.0/24 dst 192.168.136.0/24
dir in priority 2344 ptype main
tmpl src 1.1.1.137 dst 1.1.1.136
proto esp reqid 16385 mode tunnel
net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is
at 1.1.1.137 and 192.168.137.1. From that host:
ping -I 192.168.137.1 192.168.136.1 -> success
ping -I 192.168.137.1 192.168.136.2 -> silent failure
Thanks,
Mike
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: IPsec tunnel forwarding in net-next-2.6 since 452edd59
2011-03-15 18:30 IPsec tunnel forwarding in net-next-2.6 since 452edd59 Michael Smith
@ 2011-03-15 22:16 ` Eric Dumazet
2011-03-15 22:28 ` David Miller
2011-03-15 22:51 ` Michael Smith
0 siblings, 2 replies; 5+ messages in thread
From: Eric Dumazet @ 2011-03-15 22:16 UTC (permalink / raw)
To: Michael Smith; +Cc: netdev, David Miller
Le mardi 15 mars 2011 à 14:30 -0400, Michael Smith a écrit :
> Hi,
>
> I'm able to ping across a tunnel to a peer running net-next-2.6, but
> only to an interface on the peer; trying to ping a host behind the peer
> fails. The incoming packet shows up in encrypted and decrypted form in
> tcpdump, but it's not forwarded. None of the XFRM error counters are
> incremented; the packets just silently fail to be forwarded.
>
> There are no iptables rules and net.ipv4.ip_forward=1. The same config
> works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2:
>
> xfrm: Return dst directly from xfrm_lookup()
>
> Instead of on the stack.
>
>
> ip xfrm policy:
>
> src 192.168.136.0/24 dst 192.168.137.0/24
> dir out priority 2344 ptype main
> tmpl src 1.1.1.136 dst 1.1.1.137
> proto esp reqid 16385 mode tunnel
>
> src 192.168.137.0/24 dst 192.168.136.0/24
> dir fwd priority 2344 ptype main
> tmpl src 1.1.1.137 dst 1.1.1.136
> proto esp reqid 16385 mode tunnel
>
> src 192.168.137.0/24 dst 192.168.136.0/24
> dir in priority 2344 ptype main
> tmpl src 1.1.1.137 dst 1.1.1.136
> proto esp reqid 16385 mode tunnel
>
> net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is
> at 1.1.1.137 and 192.168.137.1. From that host:
>
> ping -I 192.168.137.1 192.168.136.1 -> success
> ping -I 192.168.137.1 192.168.136.2 -> silent failure
>
> Thanks,
Thanks for this excellent bug report !
Could you try following patch ?
[PATCH] xfrm: fix __xfrm_route_forward()
This function should return 0 in case of error, 1 if OK
commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup())
got it wrong.
Reported-and-bisected-by: Michael Smith <msmith@cbnco•com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail•com>
---
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 1ba0258..027e3c6 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2175,7 +2175,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
struct net *net = dev_net(skb->dev);
struct flowi fl;
struct dst_entry *dst;
- int res = 0;
+ int res = 1;
if (xfrm_decode_session(skb, &fl, family) < 0) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
@@ -2186,7 +2186,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, 0);
if (IS_ERR(dst)) {
- res = 1;
+ res = 0;
dst = NULL;
}
skb_dst_set(skb, dst);
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: IPsec tunnel forwarding in net-next-2.6 since 452edd59
2011-03-15 22:16 ` Eric Dumazet
@ 2011-03-15 22:28 ` David Miller
2011-03-15 22:31 ` Eric Dumazet
2011-03-15 22:51 ` Michael Smith
1 sibling, 1 reply; 5+ messages in thread
From: David Miller @ 2011-03-15 22:28 UTC (permalink / raw)
To: eric.dumazet; +Cc: msmith, netdev
From: Eric Dumazet <eric.dumazet@gmail•com>
Date: Tue, 15 Mar 2011 23:16:51 +0100
> Could you try following patch ?
>
> [PATCH] xfrm: fix __xfrm_route_forward()
>
> This function should return 0 in case of error, 1 if OK
> commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup())
> got it wrong.
>
> Reported-and-bisected-by: Michael Smith <msmith@cbnco•com>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail•com>
Thanks so much for fixing this Eric, sheesh you are so awesome that
you don't even give me enough time to fix my own bugs. :-))))
Applied, and indeed thanks to Michael for the excellent report.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: IPsec tunnel forwarding in net-next-2.6 since 452edd59
2011-03-15 22:28 ` David Miller
@ 2011-03-15 22:31 ` Eric Dumazet
0 siblings, 0 replies; 5+ messages in thread
From: Eric Dumazet @ 2011-03-15 22:31 UTC (permalink / raw)
To: David Miller; +Cc: msmith, netdev
Le mardi 15 mars 2011 à 15:28 -0700, David Miller a écrit :
> Thanks so much for fixing this Eric, sheesh you are so awesome that
> you don't even give me enough time to fix my own bugs. :-))))
>
Well, I know you must be pretty busy now linux-2.6.38 is released ;)
> Applied, and indeed thanks to Michael for the excellent report.
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: IPsec tunnel forwarding in net-next-2.6 since 452edd59
2011-03-15 22:16 ` Eric Dumazet
2011-03-15 22:28 ` David Miller
@ 2011-03-15 22:51 ` Michael Smith
1 sibling, 0 replies; 5+ messages in thread
From: Michael Smith @ 2011-03-15 22:51 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev, David Miller
On Tue, 15 Mar 2011, Eric Dumazet wrote:
> Could you try following patch ?
>
> [PATCH] xfrm: fix __xfrm_route_forward()
>
> This function should return 0 in case of error, 1 if OK
> commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup())
> got it wrong.
That does the trick, thanks! Nice catch.
Mike
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-03-15 22:51 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-15 18:30 IPsec tunnel forwarding in net-next-2.6 since 452edd59 Michael Smith
2011-03-15 22:16 ` Eric Dumazet
2011-03-15 22:28 ` David Miller
2011-03-15 22:31 ` Eric Dumazet
2011-03-15 22:51 ` Michael Smith
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox