Messages in this thread | | | Date | Thu, 3 May 2018 13:40:29 +0800 | From | Herbert Xu <> | Subject | Re: [PATCH] net/xfrm: Fix lookups for states with spi == 0 |
| |
On Wed, May 02, 2018 at 01:41:36PM +0100, Dmitry Safonov wrote: > > But still it's possible to create ipsec with zero SPI. > And it seems not making sense to search for a state with SPI hash if > request has zero SPI.
Fair enough. In fact a zero SPI is legal and defined for IPcomp.
The bug arose from this patch:
commit 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Author: Masahide NAKAMURA <nakam@linux-ipv6.org> Date: Wed Sep 27 22:21:52 2006 -0700
[XFRM]: Do not add a state whose SPI is zero to the SPI hash.
SPI=0 is used for acquired IPsec SA and MIPv6 RO state. Such state should not be added to the SPI hash because we do not care about it on deleting path.
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
I think it would be better to revert this.
Cheers, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
| |