Skip to contentSkip to conversation

: Restrict authentication algorithm only when inbound transformation protocol is IPsec.

PATCH In review Masahide NAKAMURA 2 participants 2 messages Jul 29, 2006 – Aug 2, 2006

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Masahide NAKAMURA

author
#0 lore raw

PATCH 14/23 : Restrict authentication algorithm only when inbound transformation protocol is IPsec.

For Mobile IPv6 usage, routing header or destination options header is used and it doesn't require this compare. It is checked only when IPsec template. Based on MIPL2 kernel patch.

---
 net/xfrm/xfrm_policy.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
net/xfrm/xfrm_policy.c +2 -1
index 1663ffa..e3c71b6 100644
@@ -952,7 +952,8 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, st
 		(x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
 		(x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
 		x->props.mode == tmpl->mode &&
-		(tmpl->aalgos & (1<<x->props.aalgo)) &&
+		((tmpl->aalgos & (1<<x->props.aalgo)) ||
+		 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
 		!(x->props.mode != XFRM_MODE_TRANSPORT &&
 		  xfrm_state_addr_cmp(tmpl, x, family));
 }
Signature · 1 line
1.4.1
maintainer
#1 lore raw

From: Masahide NAKAMURA <[email protected]>
Date: Sat, 29 Jul 2006 18:30:38 +0900

net/xfrm/xfrm_policy.c xfrm_state_ok(struct xfrm_tmpl *tmpl, st · line 956

Quoted 3 lines
net/xfrm/xfrm_policy.c +2 -1
-		(tmpl->aalgos & (1<<x->props.aalgo)) &&
+		((tmpl->aalgos & (1<<x->props.aalgo)) ||
+		 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&

This is another instance of a xfrm_id_proto_match() call which will always evaluate to true, because the userproto argument is IPSEC_PROTO_ANY.

+static inline int xfrm_id_proto_match(u8 proto, u8 userproto) +{
+ return (userproto == IPSEC_PROTO_ANY || proto == userproto);
+}

Can you elaborate on how this is supposed to work? It does not seem intentional that all of these calls will always evaluate to true.