[XFRM]: Fix wildcard as tunnel source

Hashing SAs by source address breaks templates with wildcards as tunnel
source since the source address used for hashing/lookup is still 0/0.
Move source address lookup to xfrm_tmpl_resolve_one() so we can use the
real address in the lookup.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 4d6dc627df9b07212cdba144706096a01dcf81b6..11e0b1d6bd4734963a8675b7d4c25aa1867607f0 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -222,6 +222,7 @@ struct xfrm_policy_afinfo {
        struct dst_ops          *dst_ops;
        void                    (*garbage_collect)(void);
        int                     (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
+       int                     (*get_saddr)(xfrm_address_t *saddr, xfrm_address_t *daddr);
        struct dst_entry        *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
        int                     (*bundle_create)(struct xfrm_policy *policy, 
                                                 struct xfrm_state **xfrm, 
@@ -630,6 +631,18 @@ secpath_reset(struct sk_buff *skb)
 #endif
 }
 
+static inline int
+xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
+{
+       switch (family) {
+       case AF_INET:
+               return addr->a4 == 0;
+       case AF_INET6:
+               return ipv6_addr_any((struct in6_addr *)&addr->a6);
+       }
+       return 0;
+}
+
 static inline int
 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 {

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 479598566f1decf0bd0374dc30d5cc43f01ece8e..eabcd27b176730d83e42ce599e28c7a7e3407e0f 100644 (file)
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -21,6 +21,25 @@ static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
        return __ip_route_output_key((struct rtable**)dst, fl);
 }
 
+static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
+{
+       struct rtable *rt;
+       struct flowi fl_tunnel = {
+               .nl_u = {
+                       .ip4_u = {
+                               .daddr = daddr->a4,
+                       },
+               },
+       };
+
+       if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
+               saddr->a4 = rt->rt_src;
+               dst_release(&rt->u.dst);
+               return 0;
+       }
+       return -EHOSTUNREACH;
+}
+
 static struct dst_entry *
 __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
 {
@@ -298,6 +317,7 @@ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
        .family =               AF_INET,
        .dst_ops =              &xfrm4_dst_ops,
        .dst_lookup =           xfrm4_dst_lookup,
+       .get_saddr =            xfrm4_get_saddr,
        .find_bundle =          __xfrm4_find_bundle,
        .bundle_create =        __xfrm4_bundle_create,
        .decode_session =       _decode_session4,

diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 6a2a4ab42772a00bd2978b93dd2de07fac3976b9..fe2034494d0854e7f22d9e40147c4dc16b76bdc4 100644 (file)
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -42,21 +42,6 @@ __xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        x->props.saddr = tmpl->saddr;
        if (x->props.saddr.a4 == 0)
                x->props.saddr.a4 = saddr->a4;
-       if (tmpl->mode == XFRM_MODE_TUNNEL && x->props.saddr.a4 == 0) {
-               struct rtable *rt;
-               struct flowi fl_tunnel = {
-                       .nl_u = {
-                               .ip4_u = {
-                                       .daddr = x->id.daddr.a4,
-                               }
-                       }
-               };
-               if (!xfrm_dst_lookup((struct xfrm_dst **)&rt,
-                                    &fl_tunnel, AF_INET)) {
-                       x->props.saddr.a4 = rt->rt_src;
-                       dst_release(&rt->u.dst);
-               }
-       }
        x->props.mode = tmpl->mode;
        x->props.reqid = tmpl->reqid;
        x->props.family = AF_INET;

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 9391c4c94febefb2d75950697bb5a08c044889d1..6a252e2134d11cf8629d64c3dc56592f6625fec8 100644 (file)
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -34,6 +34,26 @@ static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
        return err;
 }
 
+static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
+{
+       struct rt6_info *rt;
+       struct flowi fl_tunnel = {
+               .nl_u = {
+                       .ip6_u = {
+                               .daddr = *(struct in6_addr *)&daddr->a6,
+                       },
+               },
+       };
+
+       if (!xfrm6_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
+               ipv6_get_saddr(&rt->u.dst, (struct in6_addr *)&daddr->a6,
+                              (struct in6_addr *)&saddr->a6);
+               dst_release(&rt->u.dst);
+               return 0;
+       }
+       return -EHOSTUNREACH;
+}
+
 static struct dst_entry *
 __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
 {
@@ -362,6 +382,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
        .family =               AF_INET6,
        .dst_ops =              &xfrm6_dst_ops,
        .dst_lookup =           xfrm6_dst_lookup,
+       .get_saddr =            xfrm6_get_saddr,
        .find_bundle =          __xfrm6_find_bundle,
        .bundle_create =        __xfrm6_bundle_create,
        .decode_session =       _decode_session6,

diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index d88cd92c864e6d9cad400a4288e0beb88bfaa002..711bfafb2472dfd5fda8dc04c19a7f536355e64c 100644 (file)
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -42,22 +42,6 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
        if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
                memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
-       if (tmpl->mode == XFRM_MODE_TUNNEL && ipv6_addr_any((struct in6_addr*)&x->props.saddr)) {
-               struct rt6_info *rt;
-               struct flowi fl_tunnel = {
-                       .nl_u = {
-                               .ip6_u = {
-                                       .daddr = *(struct in6_addr *)daddr,
-                               }
-                       }
-               };
-               if (!xfrm_dst_lookup((struct xfrm_dst **)&rt,
-                                    &fl_tunnel, AF_INET6)) {
-                       ipv6_get_saddr(&rt->u.dst, (struct in6_addr *)daddr,
-                                      (struct in6_addr *)&x->props.saddr);
-                       dst_release(&rt->u.dst);
-               }
-       }
        x->props.mode = tmpl->mode;
        x->props.reqid = tmpl->reqid;
        x->props.family = AF_INET6;

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 537854fe47ca5738772589b875313c091c96e96d..b6e2e79d72612be4f99d82d3b8eb7027010c386b 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1107,6 +1107,20 @@ int __xfrm_sk_clone_policy(struct sock *sk)
        return 0;
 }
 
+static int
+xfrm_get_saddr(xfrm_address_t *local, xfrm_address_t *remote,
+              unsigned short family)
+{
+       int err;
+       struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
+
+       if (unlikely(afinfo == NULL))
+               return -EINVAL;
+       err = afinfo->get_saddr(local, remote);
+       xfrm_policy_put_afinfo(afinfo);
+       return err;
+}
+
 /* Resolve list of templates for the flow, given policy. */
 
 static int
@@ -1118,6 +1132,7 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
        int i, error;
        xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
        xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
+       xfrm_address_t tmp;
 
        for (nx=0, i = 0; i < policy->xfrm_nr; i++) {
                struct xfrm_state *x;
@@ -1128,6 +1143,12 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
                if (tmpl->mode == XFRM_MODE_TUNNEL) {
                        remote = &tmpl->id.daddr;
                        local = &tmpl->saddr;
+                       if (xfrm_addr_any(local, family)) {
+                               error = xfrm_get_saddr(&tmp, remote, family);
+                               if (error)
+                                       goto fail;
+                               local = &tmp;
+                       }
                }
 
                x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);