On Thu, Mar 21, 2019 at 09:06:05PM -0700, Cong Wang wrote: > > Good point. Replacing IPSEC_PROTO_ANY with zero should > work too, but on the other hand, id.proto is still never allowed to > be any other protocol than these 6 listed, no?
It should never be IPSEC_PROTO_ANY since that's used as a wildcard. IOW if you're going to tighten up the check for the id.proto filed in an actual state, you should distinguish between the case of an ID that's used to add/modify a state vs. an ID that's be used to query a state. IPSEC_PROTO_ANY and zero should be denied in the first case and allowed in the second case. Cheers, -- Email: Herbert Xu <herb...@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
