Re: [PATCH ipsec] xfrm: policy: match with both mark and mask on user interfaces

2020-06-16 Thread Xin Long
On Mon, Jun 15, 2020 at 5:56 PM Tobias Brunner wrote: > > Hi Xin, > > > To fix this duplicated policies issue, and also fix the issue in > > commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), > > when doing add/del/get/update on user interfaces, this patch is to change > > to

Re: [PATCH ipsec] xfrm: policy: match with both mark and mask on user interfaces

2020-06-15 Thread Tobias Brunner
Hi Xin, > To fix this duplicated policies issue, and also fix the issue in > commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), > when doing add/del/get/update on user interfaces, this patch is to change > to look up a policy with both mark and mask by doing: > > mark.v ==

[PATCH ipsec] xfrm: policy: match with both mark and mask on user interfaces

2020-06-15 Thread Xin Long
In commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), it would take 'priority' to make a policy unique, and allow duplicated policies with different 'priority' to be added, which is not expected by userland, as Tobias reported in strongswan. To fix this duplicated policies iss