Messages in this thread | | | Date | Thu, 4 Mar 2021 10:37:30 +0100 | From | Steffen Klassert <> | Subject | Re: [PATCH v2 1/1] xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume |
| |
On Tue, Mar 02, 2021 at 08:00:04AM +1300, Evan Nimmo wrote: > A situation can occur where the interface bound to the sk is different > to the interface bound to the sk attached to the skb. The interface > bound to the sk is the correct one however this information is lost inside > xfrm_output2 and instead the sk on the skb is used in xfrm_output_resume > instead. This assumes that the sk bound interface and the bound interface > attached to the sk within the skb are the same which can lead to lookup > failures inside ip_route_me_harder resulting in the packet being dropped. > > We have an l2tp v3 tunnel with ipsec protection. The tunnel is in the > global VRF however we have an encapsulated dot1q tunnel interface that > is within a different VRF. We also have a mangle rule that marks the > packets causing them to be processed inside ip_route_me_harder. > > Prior to commit 31c70d5956fc ("l2tp: keep original skb ownership") this > worked fine as the sk attached to the skb was changed from the dot1q > encapsulated interface to the sk for the tunnel which meant the interface > bound to the sk and the interface bound to the skb were identical. > Commit 46d6c5ae953c ("netfilter: use actual socket sk rather than skb sk > when routing harder") fixed some of these issues however a similar > problem existed in the xfrm code. > > Fixes: 31c70d5956fc ("l2tp: keep original skb ownership") > > Signed-off-by: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
Applied, thanks Evan!
| |