| Message ID | a5e26e7eb3172c2ddebdc5b006f3afaf3e4adb5c.1587971664.git.lucien.xin@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | stephen hemminger |
| Headers | show |
| Series | [iproute2] xfrm: also check for ipv6 state in xfrm_state_keep | expand |
On Mon, Apr 27, 2020 at 9:14 AM Xin Long <lucien.xin@gmail.com> wrote: > > As commit f9d696cf414c ("xfrm: not try to delete ipcomp states when using > deleteall") does, this patch is to fix the same issue for ip6 state where > xsinfo->id.proto == IPPROTO_IPV6. > > # ip xfrm state add src 2000::1 dst 2000::2 spi 0x1000 \ > proto comp comp deflate mode tunnel sel src 2000::1 dst \ > 2000::2 proto gre > # ip xfrm sta deleteall > Failed to send delete-all request > : Operation not permitted > > Note that the xsinfo->proto in common states can never be IPPROTO_IPV6. > > Fixes: f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall") > Reported-by: Xiumei Mu <xmu@redhat.com> > Signed-off-by: Xin Long <lucien.xin@gmail.com> > --- > ip/xfrm_state.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c > index d68f600..f4bf335 100644 > --- a/ip/xfrm_state.c > +++ b/ip/xfrm_state.c > @@ -1131,7 +1131,8 @@ static int xfrm_state_keep(struct nlmsghdr *n, void *arg) > if (!xfrm_state_filter_match(xsinfo)) > return 0; > > - if (xsinfo->id.proto == IPPROTO_IPIP) > + if (xsinfo->id.proto == IPPROTO_IPIP || > + xsinfo->id.proto == IPPROTO_IPV6) > return 0; > > if (xb->offset > xb->size) { > -- > 2.1.0 > LGTM. Acked-by: Andrea Claudi <aclaudi@redhat.com>
On Mon, 27 Apr 2020 15:14:24 +0800 Xin Long <lucien.xin@gmail.com> wrote: > As commit f9d696cf414c ("xfrm: not try to delete ipcomp states when using > deleteall") does, this patch is to fix the same issue for ip6 state where > xsinfo->id.proto == IPPROTO_IPV6. > > # ip xfrm state add src 2000::1 dst 2000::2 spi 0x1000 \ > proto comp comp deflate mode tunnel sel src 2000::1 dst \ > 2000::2 proto gre > # ip xfrm sta deleteall > Failed to send delete-all request > : Operation not permitted > > Note that the xsinfo->proto in common states can never be IPPROTO_IPV6. > > Fixes: f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall") > Reported-by: Xiumei Mu <xmu@redhat.com> > Signed-off-by: Xin Long <lucien.xin@gmail.com> Applied
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index d68f600..f4bf335 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -1131,7 +1131,8 @@ static int xfrm_state_keep(struct nlmsghdr *n, void *arg) if (!xfrm_state_filter_match(xsinfo)) return 0; - if (xsinfo->id.proto == IPPROTO_IPIP) + if (xsinfo->id.proto == IPPROTO_IPIP || + xsinfo->id.proto == IPPROTO_IPV6) return 0; if (xb->offset > xb->size) {
As commit f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall") does, this patch is to fix the same issue for ip6 state where xsinfo->id.proto == IPPROTO_IPV6. # ip xfrm state add src 2000::1 dst 2000::2 spi 0x1000 \ proto comp comp deflate mode tunnel sel src 2000::1 dst \ 2000::2 proto gre # ip xfrm sta deleteall Failed to send delete-all request : Operation not permitted Note that the xsinfo->proto in common states can never be IPPROTO_IPV6. Fixes: f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> --- ip/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)