Commit:     1e5dc146173251e7baad9a1f7586d5a009b6d9f9
Parent:     a47ed4cd8cb0709723392f5b841e9015f765d0a6
Author:     Masahide NAKAMURA <[EMAIL PROTECTED]>
AuthorDate: Fri Aug 24 19:08:55 2007 +0900
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Wed Oct 10 16:48:33 2007 -0700

    [IPV6] IPSEC: Omit redirect for tunnelled packet.
    IPv6 IPsec tunnel gateway incorrectly sends redirect to
    router or sender when network device the IPsec tunnelled packet
    is arrived is the same as the one the decapsulated packet
    is sent.
    With this patch, it omits to send the redirect when the forwarding
    skbuff carries secpath, since such skbuff should be assumed as
    a decapsulated packet from IPsec tunnel by own.
    It may be a rare case for an IPsec security gateway, however
    it is not rare when the gateway is MIPv6 Home Agent since
    the another tunnel end-point is Mobile Node and it changes
    the attached network.
    Signed-off-by: Masahide NAKAMURA <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/ipv6/ip6_output.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 26de3c0..e46d468 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -441,8 +441,10 @@ int ip6_forward(struct sk_buff *skb)
        /* IPv6 specs say nothing about it, but it is clear that we cannot
           send redirects to source routed frames.
+          We don't send redirects to frames decapsulated from IPsec.
-       if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0) {
+       if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
+           !skb->sp) {
                struct in6_addr *target = NULL;
                struct rt6_info *rt;
                struct neighbour *n = dst->neighbour;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to