[XFRM]: Fix wildcard as tunnel source

Hashing SAs by source address breaks templates with wildcards as tunnel
source since the source address used for hashing/lookup is still 0/0.
Move source address lookup to xfrm_tmpl_resolve_one() so we can use the
real address in the lookup.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 20 insertions, 0 deletions

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 479598566f1d..eabcd27b1767 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -21,6 +21,25 @@ static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
         return __ip_route_output_key((struct rtable**)dst, fl);
 }
 
+static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
+{
+        struct rtable *rt;
+        struct flowi fl_tunnel = {
+                .nl_u = {
+                        .ip4_u = {
+                                .daddr = daddr->a4,
+                        },
+                },
+        };
+
+        if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
+                saddr->a4 = rt->rt_src;
+                dst_release(&rt->u.dst);
+                return 0;
+        }
+        return -EHOSTUNREACH;
+}
+
 static struct dst_entry *
 __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
 {
@@ -298,6 +317,7 @@ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
         .family =               AF_INET,
         .dst_ops =              &xfrm4_dst_ops,
         .dst_lookup =           xfrm4_dst_lookup,
+        .get_saddr =            xfrm4_get_saddr,
         .find_bundle =          __xfrm4_find_bundle,
         .bundle_create =        __xfrm4_bundle_create,
         .decode_session =       _decode_session4,