diff options
| author | Gao feng <gaofeng@cn.fujitsu.com> | 2012-05-26 01:30:53 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-05-27 01:11:22 -0400 |
| commit | 0c1833797a5a6ec23ea9261d979aa18078720b74 (patch) | |
| tree | 1ea0d0ee1fb3915b30f7b40a91c0d047db5aeac3 /net/xfrm | |
| parent | 91657eafb64b4cb53ec3a2fbc4afc3497f735788 (diff) | |
| download | linux-0c1833797a5a6ec23ea9261d979aa18078720b74.tar.gz linux-0c1833797a5a6ec23ea9261d979aa18078720b74.tar.bz2 linux-0c1833797a5a6ec23ea9261d979aa18078720b74.zip | |
ipv6: fix incorrect ipsec fragment
Since commit ad0081e43a
"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
the fragment of packets is incorrect.
because tunnel mode needs IPsec headers and trailer for all fragments,
while on transport mode it is sufficient to add the headers to the
first fragment and the trailer to the last.
so modify mtu and maxfraglen base on ipsec mode and if fragment is first
or last.
with my test,it work well(every fragment's size is the mtu)
and does not trigger slow fragment path.
Changes from v1:
though optimization, mtu_prev and maxfraglen_prev can be delete.
replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL.
add fuction ip6_append_data_mtu to make codes clearer.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
| -rw-r--r-- | net/xfrm/xfrm_policy.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index c53e8f42aa75..ccfbd328a69d 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1921,6 +1921,9 @@ no_transform: } ok: xfrm_pols_put(pols, drop_pols); + if (dst && dst->xfrm && + dst->xfrm->props.mode == XFRM_MODE_TUNNEL) + dst->flags |= DST_XFRM_TUNNEL; return dst; nopol: |