Re: [PATCH 16/44] [XFRM] IPV6: Restrict bundle reusing

[Masahide NAKAMURA <nakam@linux-ipv6.org>]

David Miller wrote:
> From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> Date: Thu, 24 Aug 2006 00:02:17 +0900
> 
>> From: Masahide NAKAMURA <nakam@linux-ipv6.org>
>>
>> For outbound transformation, bundle is checked whether it is
>> suitable for current flow to be reused or not. In such IPv6 case
>> as below, transformation may apply incorrect bundle for the flow instead
>> of creating another bundle:
>>
>> - The policy selector has destination prefix length < 128
>>   (Two or more addresses can be matched it)
>> - Its bundle holds dst entry of default route whose prefix length < 128
>>   (Previous traffic was used such route as next hop)
>> - The policy and the bundle were used a transport mode state and
>>   this time flow address is not matched the bundled state.
>>
>> This issue is found by Mobile IPv6 usage to protect mobility signaling
>> by IPsec, but it is not a Mobile IPv6 specific.
>> This patch adds strict check to xfrm_bundle_ok() for each
>> state mode and address when prefix length is less than 128.
>>
>> Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
>> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> 
> Applied.  Maybe ipv4 side wants to check for prefix length < 32?
> Or does it not matter for some reason under ipv4?

Logically yes. But I was not clear IPv4 __xfrm4_find_bundle()
has no prefix check as opposed to IPv6 one then I couldn't include it.


-- 
Masahide NAKAMURA