aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv6/ip6_output.c
diff options
context:
space:
mode:
authorMasahide NAKAMURA <nakam@linux-ipv6.org>2007-08-24 06:08:55 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-10 19:48:33 -0400
commit1e5dc146173251e7baad9a1f7586d5a009b6d9f9 (patch)
treeed816741827aac7239e24187df09657ff6f0d21d /net/ipv6/ip6_output.c
parenta47ed4cd8cb0709723392f5b841e9015f765d0a6 (diff)
[IPV6] IPSEC: Omit redirect for tunnelled packet.
IPv6 IPsec tunnel gateway incorrectly sends redirect to router or sender when network device the IPsec tunnelled packet is arrived is the same as the one the decapsulated packet is sent. With this patch, it omits to send the redirect when the forwarding skbuff carries secpath, since such skbuff should be assumed as a decapsulated packet from IPsec tunnel by own. It may be a rare case for an IPsec security gateway, however it is not rare when the gateway is MIPv6 Home Agent since the another tunnel end-point is Mobile Node and it changes the attached network. Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ip6_output.c')
-rw-r--r--net/ipv6/ip6_output.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 26de3c0ea31e..e46d4683eab0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -441,8 +441,10 @@ int ip6_forward(struct sk_buff *skb)
441 441
442 /* IPv6 specs say nothing about it, but it is clear that we cannot 442 /* IPv6 specs say nothing about it, but it is clear that we cannot
443 send redirects to source routed frames. 443 send redirects to source routed frames.
444 We don't send redirects to frames decapsulated from IPsec.
444 */ 445 */
445 if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0) { 446 if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
447 !skb->sp) {
446 struct in6_addr *target = NULL; 448 struct in6_addr *target = NULL;
447 struct rt6_info *rt; 449 struct rt6_info *rt;
448 struct neighbour *n = dst->neighbour; 450 struct neighbour *n = dst->neighbour;