[XFRM]: Fix wildcard as tunnel source

Hashing SAs by source address breaks templates with wildcards as tunnel
source since the source address used for hashing/lookup is still 0/0.
Move source address lookup to xfrm_tmpl_resolve_one() so we can use the
real address in the lookup.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 21 insertions, 0 deletions

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 537854fe47ca..b6e2e79d7261 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1107,6 +1107,20 @@ int __xfrm_sk_clone_policy(struct sock *sk)
         return 0;
 }
 
+static int
+xfrm_get_saddr(xfrm_address_t *local, xfrm_address_t *remote,
+               unsigned short family)
+{
+        int err;
+        struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
+
+        if (unlikely(afinfo == NULL))
+                return -EINVAL;
+        err = afinfo->get_saddr(local, remote);
+        xfrm_policy_put_afinfo(afinfo);
+        return err;
+}
+
 /* Resolve list of templates for the flow, given policy. */
 
 static int
@@ -1118,6 +1132,7 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
         int i, error;
         xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
         xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
+        xfrm_address_t tmp;
 
         for (nx=0, i = 0; i < policy->xfrm_nr; i++) {
                 struct xfrm_state *x;
@@ -1128,6 +1143,12 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
                 if (tmpl->mode == XFRM_MODE_TUNNEL) {
                         remote = &tmpl->id.daddr;
                         local = &tmpl->saddr;
+                        if (xfrm_addr_any(local, family)) {
+                                error = xfrm_get_saddr(&tmp, remote, family);
+                                if (error)
+                                        goto fail;
+                                local = &tmp;
+                        }
                 }
 
                 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);