<div>Hi Andreas, Hi Martin, Hi All,<br> <br>I have encountered one tough issue and need your all help. Please give me a help. Thanks!<br> </div>
<div>Because the need of one special project, I need to establish two tunnel (IPsec tunnel over IP-in-IP tunnel) and the three IP header is the same. detail information will be listed as followed.</div>
<div><br>The scenario is:<br>__________________________________________________________________________________________<br>{IP-in-IP Client }<-- Ip package --> {IP-in-IP server} <-- IP-in-IP package --> {IPsec Gateway} <--IPsec over IP-in-IP package--> {Client with IPsec (using tunnel mode) over IP-in-IP}<br>
-------------------------------------------------------------------------------------------------------------------------------------------------<br>Note:<br>1) two tunnel used in Client: IPsec tunnel over IP-in-IP tunnel;<br>
2) the three Sourece IP in the header used in the client of IPsec over IP-in-IP is the same. <br> <br>The issue is:<br> <br>When I initiate a ping from client of IPsec over IP-in-IP, from TCPDUMP log, we can see that the package of ICMP request can reach IP-in-IP Client and ICMP reply can also reach client of IPsec over IP-in-IP successfully but ICMP reply can not be delievered to the upper layer (ICMP reply package can not be seen on the console).<br>
<br>More Information:<br>1) The implementation of IPsec uses the method: "integrate IPsec to native IP stack" --- ie: NETKEY<br>2) The IP-In-IP configuration listed as followed: (a virtual interface IP-in-IP adopted)<br>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>ifconfig eth1 172.19.2.168 netmask 255.255.255.0<br>ip tunnel add ip-in-ip mode ipip remote 139.200.9.1 local 172.19.2.168 dev eth1<br>ip addr add <a href="http://172.19.2.168/24">172.19.2.168/24</a> dev ip-in-ip<br>
ip link set ip-in-ip up<br>route add -host 139.200.9.9 gateway 172.19.2.177 dev ip-in-ip<br>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>3) The Linux Kernel Version is: 2.6.28<br>
<br>Question: <br>1) Whether two tunnel mode (IPsec tunnel over IP-in-IP tunnel) can be supported?<br>2) The Root causes of the above issue?<br>3) Whether there are some patches of kernel can fix this issue?<br>4) Any suggestion can be given?<br>
<br>Look forward to your answer, Thanks a lot!</div>
<div> </div>
<div> </div>
<div>Hi All,<br> <br>I have encountered one tough issue and need your all help. Please give me a help. Thanks!<br> <br>The scenario is:<br>__________________________________________________________________________________________<br>
{IP-in-IP Client }<-- Ip package --> {IP-in-IP server} <-- IP-in-IP package --> {IPsec Gateway} <--IPsec over IP-in-IP package--> {Client with IPsec (using tunnel mode) over IP-in-IP}<br>-------------------------------------------------------------------------------------------------------------------------------------------------<br>
Note:<br>1) two tunnel used in Client: IPsec tunnel over IP-in-IP tunnel;<br>2) the three Sourece IP in the header used in the client of IPsec over IP-in-IP is the same. <br> <br>The issue is:<br> <br>When I initiate a ping from client of IPsec over IP-in-IP, from TCPDUMP log, we can see that the package of ICMP request can reach IP-in-IP Client and ICMP reply can also reach client of IPsec over IP-in-IP successfully but ICMP reply can not be delievered to the upper layer (ICMP reply package can not be seen on the console).<br>
<br>More Information:<br>1) The implementation of IPsec uses the method: "integrate IPsec to native IP stack" --- ie: NETKEY<br>2) The IP-In-IP configuration listed as followed: (a virtual interface IP-in-IP adopted)<br>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>ifconfig eth1 172.19.2.168 netmask 255.255.255.0<br>ip tunnel add ip-in-ip mode ipip remote 139.200.9.1 local 172.19.2.168 dev eth1<br>ip addr add <a href="http://172.19.2.168/24">172.19.2.168/24</a> dev ip-in-ip<br>
ip link set ip-in-ip up<br>route add -host 139.200.9.9 gateway 172.19.2.177 dev ip-in-ip<br>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>3) The Linux Kernel Version is: 2.6.28<br>
<br>Question: <br>1) Whether two tunnel mode (IPsec tunnel over IP-in-IP tunnel) can be supported?<br>2) The Root causes of the above issue?<br>3) Whether there are some patches of kernel can fix this issue?<br>4) Any suggestion can be given?<br>
</div>
<div> </div>
<div>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">I debug with "kgdb" and found the package has been reject in one handling branch of ICMP package. I listed the related code as followed, please help to check what caused this problem and whether there are some patches can solve this problem. PS: the linux kernel I used is LINUX2.6.28. </span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> </span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">-------------------------------------------------------------------------------------------------------------------------------------------------------------</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">nt __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> unsigned short family)</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">{</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct xfrm_policy *pol;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int npols = 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int xfrm_nr;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int pi;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int reverse;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct flowi fl;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> u8 fl_dir;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int xerr_idx = -1;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> reverse = dir & ~XFRM_POLICY_MASK;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> dir &= XFRM_POLICY_MASK;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> fl_dir = policy_to_flow_dir(dir);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> nf_nat_decode_session(skb, &fl, family);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> /* First, check used SA against their selectors. */</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (skb->sp) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int i;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> for (i=skb->sp->len-1; i>=0; i--) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct xfrm_state *x = skb->sp->xvec[i];</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (!xfrm_selector_match(&x->sel, &fl, family)) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMISMATCH);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pol = NULL;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (sk && sk->sk_policy[dir]) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pol = xfrm_sk_policy_lookup(sk, dir, &fl);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (IS_ERR(pol)) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (!pol)</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pol = flow_cache_lookup(&fl, family, fl_dir,</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_policy_lookup);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (IS_ERR(pol)) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (!pol) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_secpath_reject(xerr_idx, skb, &fl);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINNOPOLS);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 1;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pol->curlft.use_time = get_seconds();</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pols[0] = pol;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> npols ++;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">#ifdef CONFIG_XFRM_SUB_POLICY</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN,</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> &fl, family,</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_POLICY_IN);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (pols[1]) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (IS_ERR(pols[1])) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pols[1]->curlft.use_time = get_seconds();</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> npols ++;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">#endif</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (pol->action == XFRM_POLICY_ALLOW) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct sec_path *sp;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> static struct sec_path dummy;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct xfrm_tmpl *tp[XFRM_MAX_DEPTH];</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct xfrm_tmpl *stp[XFRM_MAX_DEPTH];</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> struct xfrm_tmpl **tpp = tp;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int ti = 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> int i, k;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if ((sp = skb->sp) == NULL)</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> sp = &dummy;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> for (pi = 0; pi < npols; pi++) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (pols[pi] != pol &&</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> pols[pi]->action != XFRM_POLICY_ALLOW) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINPOLBLOCK);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> goto reject;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> goto reject_error;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> for (i = 0; i < pols[pi]->xfrm_nr; i++)</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> tpp[ti++] = &pols[pi]->xfrm_vec[i];</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_nr = ti;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (npols > 1) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_tmpl_sort(stp, tpp, xfrm_nr, family);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> tpp = stp;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> /* For each tunnel xfrm, find the first matching tmpl.</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> * For each tmpl before that, find corresponding xfrm.</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> * Order is _important_. Later we will implement</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> * some barriers, but at the moment barriers</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> * are implied between each two transformations.</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> */</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> for (i = xfrm_nr-1, k = 0; i >= 0; i--) {</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> k = xfrm_policy_ok(tpp[i], sp, k, family);</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> if (k < 0) {</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> if (k < -1)</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> /* "-2 - errored_index" returned */</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> xerr_idx = -(2+k);</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINTMPLMISMATCH);</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> goto reject;</span></font></p>
<p class="MsoNormal"><font color="red" size="1" face="Arial"><span style="FONT-FAMILY: Arial; COLOR: red; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> if (secpath_has_nontransport(sp, k, &xerr_idx)) {</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINTMPLMISMATCH);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> goto reject;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_pols_put(pols, npols);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 1;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> }</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> XFRM_INC_STATS(LINUX_MIB_XFRMINPOLBLOCK);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">reject:</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_secpath_reject(xerr_idx, skb, &fl);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">reject_error:</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> xfrm_pols_put(pols, npols);</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US"> return 0;</span></font></p>
<p class="MsoNormal"><font size="1" face="Arial"><span style="FONT-FAMILY: Arial; FONT-SIZE: 9pt" lang="EN-US">} </span></font></p></div>
<div> </div>
<div><br>Look forward to your answer, Thanks a lot!<br><br> <br>Best Wishes<br>David Morris</div>