From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED,USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13FF2C4360F for ; Wed, 20 Mar 2019 05:35:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D9CFC2186A for ; Wed, 20 Mar 2019 05:35:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727640AbfCTFfj (ORCPT ); Wed, 20 Mar 2019 01:35:39 -0400 Received: from orcrist.hmeau.com ([104.223.48.154]:47004 "EHLO deadmen.hmeau.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727564AbfCTFfh (ORCPT ); Wed, 20 Mar 2019 01:35:37 -0400 Received: from gondobar.mordor.me.apana.org.au ([192.168.128.4] helo=gondobar) by deadmen.hmeau.com with esmtps (Exim 4.89 #2 (Debian)) id 1h6Tt1-0004zd-PG; Wed, 20 Mar 2019 13:35:35 +0800 Received: from herbert by gondobar with local (Exim 4.89) (envelope-from ) id 1h6Tsy-00077C-Tk; Wed, 20 Mar 2019 13:35:32 +0800 Date: Wed, 20 Mar 2019 13:35:32 +0800 From: Herbert Xu To: Cong Wang Cc: Linux Kernel Network Developers , syzbot+0bf0519d6e0de15914fe@syzkaller.appspotmail.com, Steffen Klassert Subject: Re: [Patch net] xfrm: unify xfrm protocol checks Message-ID: <20190320053532.o7hawr2vkj6fxbv7@gondor.apana.org.au> References: <20190319050824.24742-1-xiyou.wangcong@gmail.com> <20190319051739.kevpimikwthni65k@gondor.apana.org.au> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170113 (1.7.2) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Tue, Mar 19, 2019 at 01:42:53PM -0700, Cong Wang wrote: > > IIRC, it is Steffen who suggested to add IPPROTO_ROUTING/IPPROTO_DSTOPTS > back to commit 6a53b7593233. My xfrm knowledge is not enough to > figure out IPPROTO_ROUTING/IPPROTO_DSTOPTS. OK I dug into the history of xfrm_id_proto_match and this is definitely not right. The intention appears to be that IPSEC_PROTO_ANY should only match genuine IPsec protocols, i.e., AH/ESP/COMP, while the special value of zero will match everything. So I think what we should do is get rid of the validation function that you added in 6a5t3b7593233, and then change those internal functions which were incorrectly using IPSEC_PROTO_ANY to using zero instead. Does anybody still use IPPROTO_ROUTING/IPPROTO_DSTOPTS? It's always a pain when people come and add features and then don't shoulder the burden of maintaining them. Cheers, -- Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt