Messages in this thread | | | Date | Mon, 7 May 2018 08:20:37 +0200 | From | Steffen Klassert <> | Subject | Re: [PATCHv2] net/xfrm: Revert "[XFRM]: Do not add a state whose SPI is zero to the SPI hash." |
| |
On Fri, May 04, 2018 at 02:20:09AM +0100, Dmitry Safonov wrote: > This reverts commit 7b4dc3600e48 ("[XFRM]: Do not add a state whose SPI > is zero to the SPI hash."). > > Zero SPI is legal and defined for IPcomp. > We shouldn't omit adding the state to SPI hash because it'll not be > possible to delete or lookup for it afterward: > __xfrm_state_insert() obviously doesn't add hash for zero > SPI in xfrm.state_byspi, and xfrm_user_state_lookup() will fail as > xfrm_state_lookup() does lookups by hash. > > It also isn't possible to workaround from userspace as > xfrm_id_proto_match() will be always true for ah/esp/comp protos. > > v1 link: https://lkml.kernel.org/r/<20180502020220.2027-1-dima@arista.com> > > Cc: Masahide NAKAMURA <nakam@linux-ipv6.org> > Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> > Cc: Steffen Klassert <steffen.klassert@secunet.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: netdev@vger.kernel.org > Suggested-by: Herbert Xu <herbert@gondor.apana.org.au> > Signed-off-by: Dmitry Safonov <dima@arista.com>
This patch does much more than reverting the commit you mentioned. It removes all the logic that is needed to handle larval SAs.
The result is a disaster, all connections that are negotiated by an IKE deamon stop working.
On traffic triggered connections the IKE deamon inserts a new SA for each packet that matches a policy.
| |