On Thu, Mar 21, 2019 at 9:11 PM Herbert Xu wrote:
>
> On Thu, Mar 21, 2019 at 09:06:05PM -0700, Cong Wang wrote:
> >
> > Good point. Replacing IPSEC_PROTO_ANY with zero should
> > work too, but on the other hand, id.proto is still never allowed to
> > be any other protocol than these 6 listed, no?
On Thu, Mar 21, 2019 at 09:06:05PM -0700, Cong Wang wrote:
>
> Good point. Replacing IPSEC_PROTO_ANY with zero should
> work too, but on the other hand, id.proto is still never allowed to
> be any other protocol than these 6 listed, no?
It should never be IPSEC_PROTO_ANY since that's used as a wil
On Tue, Mar 19, 2019 at 10:35 PM Herbert Xu wrote:
>
> On Tue, Mar 19, 2019 at 01:42:53PM -0700, Cong Wang wrote:
> >
> > IIRC, it is Steffen who suggested to add IPPROTO_ROUTING/IPPROTO_DSTOPTS
> > back to commit 6a53b7593233. My xfrm knowledge is not enough to
> > figure out IPPROTO_ROUTING/IPPR
On Tue, Mar 19, 2019 at 01:42:53PM -0700, Cong Wang wrote:
>
> IIRC, it is Steffen who suggested to add IPPROTO_ROUTING/IPPROTO_DSTOPTS
> back to commit 6a53b7593233. My xfrm knowledge is not enough to
> figure out IPPROTO_ROUTING/IPPROTO_DSTOPTS.
OK I dug into the history of xfrm_id_proto_match a
On Mon, Mar 18, 2019 at 10:17 PM Herbert Xu wrote:
>
> On Mon, Mar 18, 2019 at 10:08:24PM -0700, Cong Wang wrote:
> >
> > +static inline bool xfrm_id_proto_valid(u8 proto)
> > +{
> > + switch (proto) {
> > + case IPPROTO_AH:
> > + case IPPROTO_ESP:
> > + case IPPROTO_COMP:
> > +#if
On Mon, Mar 18, 2019 at 10:08:24PM -0700, Cong Wang wrote:
>
> +static inline bool xfrm_id_proto_valid(u8 proto)
> +{
> + switch (proto) {
> + case IPPROTO_AH:
> + case IPPROTO_ESP:
> + case IPPROTO_COMP:
> +#if IS_ENABLED(CONFIG_IPV6)
> + case IPPROTO_ROUTING:
> + case IPPR
In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
I introduced a check for xfrm protocol, but unfortunately
xfrm_id_proto_match() could still miss IPPROTO_ROUTING which causes
entries left in net->xfrm.state_all.
This patch extracts the check from validate_tmpl() to
xfrm_id_proto_
