Re: Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

2007-05-14 Thread Joakim Koskela 
On Friday 11 May 2007 19:13:41 Patrick McHardy wrote:
> Joakim Koskela wrote:
> > I'm running a system where there might be multiple simultenously
> > active ipsec states between two hosts (ipv6, but guess it applies to
> > v4 as well) where the outer ip is the same for all states, but the
> > inner differ (using beet mode).
> >
> > The problem is that after establishing these states, it seems that the
> > one associated with outgoing traffic is selected solely by the outer
> > address (the first state matching the outer ip-pairs is used), which
> > usually results in the wrong spi and the packet being dropped at the
> > receiver.
>
> This should only pick states matching the flow:
>
> if (x->km.state == XFRM_STATE_VALID) {
>
>
> if (!xfrm_selector_match(&x->sel, fl, family) ||
> !security_xfrm_state_pol_flow_match(x, pol, fl))
> continue;
> ...
>
> I'm probably misunderstanding your configuration, could you post the
> SA selectors and addresses that result in an incorrect state being
> picked?
>
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to [EMAIL PROTECTED]
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Oh, your right. I wasn't setting the netmask correctly (zero) for the 
selectors, making them match anything. Sorry for the waste of time!

br, j

-- 
Joakim Koskela
Helsinki Institute for Information Technology (HIIT)
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

2007-05-11 Thread Patrick McHardy 
Joakim Koskela wrote:
> I'm running a system where there might be multiple simultenously
> active ipsec states between two hosts (ipv6, but guess it applies to
> v4 as well) where the outer ip is the same for all states, but the
> inner differ (using beet mode).
> 
> The problem is that after establishing these states, it seems that the
> one associated with outgoing traffic is selected solely by the outer
> address (the first state matching the outer ip-pairs is used), which
> usually results in the wrong spi and the packet being dropped at the
> receiver.


This should only pick states matching the flow:

if (x->km.state == XFRM_STATE_VALID) {


if (!xfrm_selector_match(&x->sel, fl, family) ||
!security_xfrm_state_pol_flow_match(x, pol, fl))
continue;
...

I'm probably misunderstanding your configuration, could you post the
SA selectors and addresses that result in an incorrect state being
picked?

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

2007-05-11 Thread Joakim Koskela 
Hi all, 

I'm running a system where there might be multiple simultenously
active ipsec states between two hosts (ipv6, but guess it applies to
v4 as well) where the outer ip is the same for all states, but the
inner differ (using beet mode).

The problem is that after establishing these states, it seems that the
one associated with outgoing traffic is selected solely by the outer
address (the first state matching the outer ip-pairs is used), which
usually results in the wrong spi and the packet being dropped at the
receiver.

I've circumvented the problem by modifying the state selection
algorithm in xfrm_state_find() [xfrm_state.c] to prefer, if possible,
states which also match by the inner addresses. Is this really a
problem of the selection algorithm, or might I be doing something 
wrong elsewhere?

Here's the changes I've done to make it work for me.  As said, it
prefers states with matching inner-address, but if none is found it
works as before:


diff -urN  a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
--- a/net/xfrm/xfrm_state.c 2007-05-11 15:37:35.0 +0300
+++ b/net/xfrm/xfrm_state.c 2007-05-11 15:37:35.0 +0300
@@ -374,6 +374,17 @@
(best->km.dying == x->km.dying &&
 best->curlft.add_time < 
x->curlft.add_time))
best = x;
+   else if (pol->selector.family == x->sel.family 
&&
+(pol->selector.family == AF_INET6 &&
+ !ipv6_addr_cmp((struct in6_addr 
*)&pol->selector.daddr,
+(struct in6_addr 
*)&x->sel.daddr) &&
+ !ipv6_addr_cmp((struct in6_addr 
*)&pol->selector.saddr,
+(struct in6_addr 
*)&x->sel.saddr)) ||
+(pol->selector.family == AF_INET &&
+ pol->selector.daddr.a4 == 
x->sel.daddr.a4 &&
+ pol->selector.saddr.a4 == 
x->sel.saddr.a4))
+   best = x;
+
} else if (x->km.state == XFRM_STATE_ACQ) {
acquire_in_progress = 1;
} else if (x->km.state == XFRM_STATE_ERROR ||

br, j

--
Joakim Koskela
Helsinki Institute for Information Technology, http://www.hiit.fi
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html