• Patrick McHardy's avatar
    [NETFILTER]: Fix xfrm lookup in ip_route_me_harder/ip6_route_me_harder · 3e3850e9
    Patrick McHardy authored
    ip_route_me_harder doesn't use the port numbers of the xfrm lookup and
    uses ip_route_input for non-local addresses which doesn't do a xfrm
    lookup, ip6_route_me_harder doesn't do a xfrm lookup at all.
    
    Use xfrm_decode_session and do the lookup manually, make sure both
    only do the lookup if the packet hasn't been transformed already.
    
    Makeing sure the lookup only happens once needs a new field in the
    IP6CB, which exceeds the size of skb->cb. The size of skb->cb is
    increased to 48b. Apparently the IPv6 mobile extensions need some
    more room anyway.
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    3e3850e9
xfrm4_output.c 3.93 KB