[PATCH ipsec v2 3/3] xfrm: choose protocol family by skb protocol

[PATCH ipsec v2 3/3] xfrm: choose protocol family by skb protocol

[Hannes Frederic Sowa]

We need to choose the protocol family by skb->protocol. Otherwise we
call the wrong xfrm{4,6}_local_error handler in case an ipv6 sockets is
used in ipv4 mode, in which case we should call down to xfrm4_local_error
(ip6 sockets are a superset of ip4 ones).

We are called before before ip_output functions, so skb->protocol is
not reset.

v2:
a) unchanged

Cc: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---

This patch is based on Steffen Klassert's ipsec tree.

 include/net/xfrm.h     |  4 ++--
 net/xfrm/xfrm_output.c | 10 +++++++++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index b41d2d1..ac5b025 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1728,9 +1728,9 @@ static inline int xfrm_skb_dst_mtu(struct sk_buff *skb)
 {
 	struct sock *sk = skb->sk;
 
-	if (sk && sk->sk_family == AF_INET6)
+	if (sk && skb->protocol == htons(ETH_P_IPV6))
 		return ip6_skb_dst_mtu(skb);
-	else if (sk && sk->sk_family == AF_INET)
+	else if (sk && skb->protocol == htons(ETH_P_IP))
 		return ip_skb_dst_mtu(skb);
 	return dst_mtu(skb_dst(skb));
 }
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 6f5fc61..3bb2cdc 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -216,9 +216,17 @@ int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
 
 void xfrm_local_error(struct sk_buff *skb, int mtu)
 {
+	unsigned int proto;
 	struct xfrm_state_afinfo *afinfo;
 
-	afinfo = xfrm_state_get_afinfo(skb->sk->sk_family);
+	if (skb->protocol == htons(ETH_P_IP))
+		proto = AF_INET;
+	else if (skb->protocol == htons(ETH_P_IPV6))
+		proto = AF_INET6;
+	else
+		return;
+
+	afinfo = xfrm_state_get_afinfo(proto);
 	if (!afinfo)
 		return;
 
-- 
1.8.3.1

Re: [PATCH ipsec v2 3/3] xfrm: choose protocol family by skb protocol

[Eric Dumazet]

On Sun, 2013-08-18 at 13:47 +0200, Hannes Frederic Sowa wrote:
> We need to choose the protocol family by skb->protocol. Otherwise we
> call the wrong xfrm{4,6}_local_error handler in case an ipv6 sockets is
> used in ipv4 mode, in which case we should call down to xfrm4_local_error
> (ip6 sockets are a superset of ip4 ones).
> 
> We are called before before ip_output functions, so skb->protocol is
> not reset.
> 
> v2:
> a) unchanged
> 
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Acked-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> ---

Hi Hannes

For your next patches, please add the v1/v2/v3 stuff _after_ the ---
separator as in :

Normal changelog (will be included in git history)

Signed-off-by: ....
Cc: ...
---
v2: Fix (you can omit this line if there was no change between v2 and
v1)
 diffstat
 diff


This is to have clean changelogs, with high S/N ratio ;)

Thanks !

Re: [PATCH ipsec v2 3/3] xfrm: choose protocol family by skb protocol

[Hannes Frederic Sowa]

On Sun, Aug 18, 2013 at 08:48:21AM -0700, Eric Dumazet wrote:
> On Sun, 2013-08-18 at 13:47 +0200, Hannes Frederic Sowa wrote:
> > We need to choose the protocol family by skb->protocol. Otherwise we
> > call the wrong xfrm{4,6}_local_error handler in case an ipv6 sockets is
> > used in ipv4 mode, in which case we should call down to xfrm4_local_error
> > (ip6 sockets are a superset of ip4 ones).
> > 
> > We are called before before ip_output functions, so skb->protocol is
> > not reset.
> > 
> > v2:
> > a) unchanged
> > 
> > Cc: Steffen Klassert <steffen.klassert@secunet.com>
> > Acked-by: Eric Dumazet <edumazet@google.com>
> > Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> > ---
> 
> Hi Hannes
> 
> For your next patches, please add the v1/v2/v3 stuff _after_ the ---
> separator as in :
> 
> Normal changelog (will be included in git history)
> 
> Signed-off-by: ....
> Cc: ...
> ---
> v2: Fix (you can omit this line if there was no change between v2 and
> v1)
>  diffstat
>  diff
> 
> 
> This is to have clean changelogs, with high S/N ratio ;)

Of course, I can do so.

Actually, I thought having the changelog in the commit msg is an extra
plus (even it is mostly inexpressive) because one knows there could be
more than one thread on the mailing list regarding the commit.

Thanks,

  Hannes

Re: [PATCH ipsec v2 3/3] xfrm: choose protocol family by skb protocol

[Steffen Klassert]

On Sun, Aug 18, 2013 at 01:47:01PM +0200, Hannes Frederic Sowa wrote:
> We need to choose the protocol family by skb->protocol. Otherwise we
> call the wrong xfrm{4,6}_local_error handler in case an ipv6 sockets is
> used in ipv4 mode, in which case we should call down to xfrm4_local_error
> (ip6 sockets are a superset of ip4 ones).
> 
> We are called before before ip_output functions, so skb->protocol is
> not reset.
> 
> v2:
> a) unchanged
> 
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Acked-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

All applied to the ipsec tree, thanks a lot!