From: Florian Westphal <fw@strlen.de>
To: Ren Wei <n05ec@lzu.edu.cn>
Cc: netfilter-devel@vger.kernel.org, pablo@netfilter.org,
phil@nwl.cc, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
ebiederm@xmission.com, yuantan098@gmail.com, yifanwucs@gmail.com,
tomapufckgml@gmail.com, bird@lzu.edu.cn,
wangjiexun2025@gmail.com
Subject: Re: [PATCH nf 1/1] netfilter: xt_policy: fix strict mode inbound policy matching
Date: Fri, 17 Apr 2026 14:49:14 +0200 [thread overview]
Message-ID: <aeIsSl26ZZJZ1n7U@strlen.de> (raw)
In-Reply-To: <85a95e0ef783ed8f5f4a787138cca22f995d8056.1776141503.git.wangjiexun2025@gmail.com>
Ren Wei <n05ec@lzu.edu.cn> wrote:
> From: Jiexun Wang <wangjiexun2025@gmail.com>
>
> match_policy_in() walks sec_path entries from the last transform to the
> first one, but strict policy matching needs to consume info->pol[] in
> the same forward order as the rule layout.
>
> Derive the strict-match policy position from the number of transforms
> already consumed so that multi-element inbound rules are matched
> consistently.
That hints that secpaths with len > 1 do not exist, or at least
have never been used. This has always been broken.
For the patch
Acked-by: Florian Westphal <fw@strlen.de>
prev parent reply other threads:[~2026-04-17 12:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1776141503.git.wangjiexun2025@gmail.com>
2026-04-17 12:25 ` [PATCH nf 1/1] netfilter: xt_policy: fix strict mode inbound policy matching Ren Wei
2026-04-17 12:49 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aeIsSl26ZZJZ1n7U@strlen.de \
--to=fw@strlen.de \
--cc=bird@lzu.edu.cn \
--cc=davem@davemloft.net \
--cc=ebiederm@xmission.com \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=n05ec@lzu.edu.cn \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=tomapufckgml@gmail.com \
--cc=wangjiexun2025@gmail.com \
--cc=yifanwucs@gmail.com \
--cc=yuantan098@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.