Skip to contentSkip to conversation

xfrm: Fix installation of AH IPsec SAs

PATCH Applied Tobias Brunner 2 participants 2 messages Jun 26, 2014 – Jun 30, 2014

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Tobias Brunner

author
#0 lore raw

PATCH 1/1 xfrm: Fix installation of AH IPsec SAs

The SPI check introduced in ea9884b3acf3311c8a11db67bfab21773f6f82ba was intended for IPComp SAs but actually prevented AH SAs from getting installed (depending on the SPI).

Fixes ea9884b3acf3 ("xfrm: check user specified spi for IPComp")
Cc Fan Du <[email protected]>
Signed-off-by Tobias Brunner <[email protected]>
---
 net/xfrm/xfrm_user.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
net/xfrm/xfrm_user.c +3 -4
index 412d9dc..d4db6eb 100644
@@ -177,9 +177,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 		    attrs[XFRMA_ALG_AEAD]	||
 		    attrs[XFRMA_ALG_CRYPT]	||
 		    attrs[XFRMA_ALG_COMP]	||
-		    attrs[XFRMA_TFCPAD]		||
-		    (ntohl(p->id.spi) >= 0x10000))
-
+		    attrs[XFRMA_TFCPAD])
 			goto out;
 		break;
 

@@ -207,7 +205,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 		    attrs[XFRMA_ALG_AUTH]	||
 		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
 		    attrs[XFRMA_ALG_CRYPT]	||
-		    attrs[XFRMA_TFCPAD])
+		    attrs[XFRMA_TFCPAD]		||
+		    (ntohl(p->id.spi) >= 0x10000))
 			goto out;
 		break;
Signature · 1 line
1.9.1
maintainer Applied
#1 lore raw
Quoted 3 lines · Tobias Brunner

The SPI check introduced in ea9884b3acf3311c8a11db67bfab21773f6f82ba was intended for IPComp SAs but actually prevented AH SAs from getting installed (depending on the SPI).

Yes, this patch was apparently wrong.

Quoted 4 lines
Fixes ea9884b3acf3 ("xfrm: check user specified spi for IPComp")
Cc Fan Du <[email protected]>
Signed-off-by Tobias Brunner <[email protected]>

Applied to the ipsec tree, thanks a lot Tobias!