kernel-ark/net
Patrick McHardy ee68cea2c2 [NETFILTER]: Fix xfrm lookup after SNAT
To find out if a packet needs to be handled by IPsec after SNAT, packets
are currently rerouted in POST_ROUTING and a new xfrm lookup is done. This
breaks SNAT of non-unicast packets to non-local addresses because the
packet is routed as incoming packet and no neighbour entry is bound to the
dst_entry. In general, it seems to be a bad idea to replace the dst_entry
after the packet was already sent to the output routine because its state
might not match what's expected.

This patch changes the xfrm lookup in POST_ROUTING to re-use the original
dst_entry without routing the packet again. This means no policy routing
can be used for transport mode transforms (which keep the original route)
when packets are SNATed to match the policy, but it looks like the best
we can do for now.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-02-15 01:34:23 -08:00
..
802 [P8023]: Fix tainting of kernel. 2006-02-13 15:38:42 -08:00
8021q [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
appletalk [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
atm [ATM]: Ratelimit atmsvc failure messages 2006-02-13 15:34:58 -08:00
ax25 [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
bluetooth [Bluetooth] Fix NULL pointer dereferences of the HCI socket 2006-02-13 11:40:03 +01:00
bridge [BRIDGE]: Better fix for netfilter missing symbol has_bridge_parent 2006-02-13 15:43:58 -08:00
core [NET]: Revert skb_copy_datagram_iovec() recursion elimination. 2006-02-13 16:06:10 -08:00
dccp [PATCH] remove bogus asm/bug.h includes. 2006-02-07 20:56:35 -05:00
decnet [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
econet [ECONET]: Use macro for spinlock_t definition. 2006-01-04 13:56:08 -08:00
ethernet [NET]: Use newer is_multicast_ether_addr() in some files 2006-01-06 13:05:58 -08:00
ieee80211 [PATCH] Typo corrections for ieee80211 2006-01-30 17:41:36 -05:00
ipv4 [NETFILTER]: Fix xfrm lookup after SNAT 2006-02-15 01:34:23 -08:00
ipv6 [IPV6] Don't store dst_entry for RAW socket 2006-02-13 15:56:13 -08:00
ipx [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
irda [IRDA]: out of range array access 2006-02-09 16:59:48 -08:00
key [AF_KEY]: no message type set 2006-01-24 12:57:19 -08:00
lapb
llc
netfilter [NETFILTER] Fix Kconfig menu level for x_tables 2006-02-13 15:42:48 -08:00
netlink [NETLINK] genetlink: Fix bugs spotted by Andrew Morton. 2006-02-13 15:51:24 -08:00
netrom [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
packet [NET]: Fix some whitespace issues in af_packet.c 2006-01-23 16:28:02 -08:00
rose [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
rxrpc [NET]: "signed long" -> "long" 2006-01-17 13:03:54 -08:00
sched [PKT_SCHED]: Handle SCTP/DCCP in sfq_hash 2006-01-17 13:01:06 -08:00
sctp [SCTP]: Fix 'fast retransmit' to send a TSN only once. 2006-02-02 16:57:31 -08:00
sunrpc SUNRPC: Move upcall out of auth->au_ops->crcreate() 2006-02-01 12:52:25 -05:00
tipc [TIPC] Avoid polluting the global namespace 2006-01-18 00:45:16 +01:00
unix [PATCH] mutex subsystem, semaphore to mutex: VFS, ->i_sem 2006-01-09 15:59:24 -08:00
wanrouter [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
x25 [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
xfrm [IPSEC]: Fix strange IPsec freeze. 2006-02-13 16:01:27 -08:00
compat.c
Kconfig [NET]: Add CONFIG_NETDEBUG to suppress bad packet messages. 2006-02-02 20:40:09 -08:00
Makefile [TIPC] Initial merge 2006-01-12 14:06:31 -08:00
nonet.c
socket.c [PATCH] percpu data: only iterate over possible CPUs 2006-02-05 11:06:51 -08:00
sysctl_net.c
TUNABLE