summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorTobias Brunner <tobias@strongswan.org>2017-12-21 19:32:24 +0300
committerDavid S. Miller <davem@davemloft.net>2017-12-27 01:14:56 +0300
commit09ee9dba9611cd382fd360a99ad1c2fa23bfdca8 (patch)
tree3c9b69538cebcb5945e61633378069e85b8d221b /net
parent18feb87105c3c16dc01e6981a6aafb175679b997 (diff)
downloadlinux-09ee9dba9611cd382fd360a99ad1c2fa23bfdca8.tar.xz
ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT
If SNAT modifies the source address the resulting packet might match an IPsec policy, reinject the packet if that's the case. The exact same thing is already done for IPv4. Signed-off-by: Tobias Brunner <tobias@strongswan.org> Acked-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/ip6_output.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ece2781a31b2..bcdb615aed6e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -138,6 +138,14 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
return ret;
}
+#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
+ /* Policy lookup after SNAT yielded a new policy */
+ if (skb_dst(skb)->xfrm) {
+ IPCB(skb)->flags |= IPSKB_REROUTED;
+ return dst_output(net, sk, skb);
+ }
+#endif
+
if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
dst_allfrag(skb_dst(skb)) ||
(IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))