Commit:     3b26a9a655ee73a87071a9f6a1fdd5311e31d7c9
Parent:     1e5dc146173251e7baad9a1f7586d5a009b6d9f9
Author:     Masahide NAKAMURA <[EMAIL PROTECTED]>
AuthorDate: Fri Aug 24 23:33:01 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Wed Oct 10 16:48:33 2007 -0700

    [IPV4] IPSEC: Omit redirect for tunnelled packet.
    IPv4 IPsec tunnel gateway incorrectly sends redirect to
    sender if it is onlink host when network device the IPsec tunnelled
    packet is arrived is the same as the one the decapsulated packet
    is sent.
    With this patch, it omits to send the redirect when the forwarding
    skbuff carries secpath, since such skbuff should be assumed as
    a decapsulated packet from IPsec tunnel by own.
    Request for comments:
    Alternatively we'd have another way to change net/ipv4/route.c
    (__mkroute_input) to use RTCF_DOREDIRECT flag unless skbuff
    has no secpath. It is better than this patch at performance
    point of view because IPv4 redirect judgement is done at
    routing slow-path. However, it should be taken care of resource
    changes between SAD(XFRM states) and routing table. In other words,
    When IPv4 SAD is changed does the related routing entry go to its
    slow-path? If not, it is reasonable to apply this patch.
    Signed-off-by: Masahide NAKAMURA <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/ipv4/ip_forward.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 8c95cf0..afbf938 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -105,7 +105,7 @@ int ip_forward(struct sk_buff *skb)
         *      We now generate an ICMP HOST REDIRECT giving the route
         *      we calculated.
-       if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr)
+       if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb->sp)
        skb->priority = rt_tos2priority(iph->tos);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to