From: root <root@bern>
To: Sabrina Dubroca <sd@queasysnail.net>
Cc: Antony Antony <antony.antony@secunet.com>,
Steffen Klassert <steffen.klassert@secunet.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, David Ahern <dsahern@kernel.org>,
Jamal Hadi Salim <hadi@cyberus.ca>, Shuah Khan <shuah@kernel.org>,
netdev@vger.kernel.org, Yan Yan <evitayan@google.com>,
Tobias Brunner <tobias@strongswan.org>,
Florian Westphal <fw@strlen.de>,
linux-kselftest@vger.kernel.org, linux-doc@vger.kernel.org
Subject: Re: [PATCH ipsec v2 1/6] xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups
Date: Mon, 21 Sep 2026 22:27:11 +0200 [thread overview]
Message-ID: <arGTH94PM_oswTpF@bern> (raw)
In-Reply-To: <arEw6qLcr_YEI8Wl@krikkit>
On Mon, Sep 21, 2026 at 03:28:10PM +0200, Sabrina Dubroca wrote:
> 2026-09-08, 08:48:45 +0200, Antony Antony wrote:
> > Add __xfrm_state_lookup_exact(); wire it into DELSA/GETSA
>
> On the "other proto" branch of xfrm_user_state_lookup(), we call
> xfrm_state_lookup_byaddr() -> __xfrm_state_lookup_byaddr(), which
> still does a "loose" mark match:
>
> if ((mark & x->mark.m) != x->mark.v)
> continue;
>
> Is that ok?
I think so. I felt byaddr is not used and aslo since there is no unique spi
if touch it dragons may wake up:) most used cases with SPI.
> That's the only thing I've noticed in the series.
>
>
> I guess someone could claim that this patch changes behavior, but if a
> user somewhere notices it, I think that would mean they were relying
> on insertion order to delete/etc the right SA.
yes that is a risk. I tried find use cases and got nowhere.
And concluded it was an oversight. Also note the
cover letter, "policy" had similar change a while ago.
No one complained yet?
next prev parent reply other threads:[~2026-09-21 20:37 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-08 6:48 [PATCH ipsec v2 0/6] xfrm: state: exact mark/mask match for control-plane SA lookups Antony Antony
2026-09-08 6:48 ` [PATCH ipsec v2 1/6] xfrm: state: exact mark/mask match for SPI-keyed " Antony Antony
2026-09-21 13:28 ` Sabrina Dubroca
2026-09-21 20:27 ` root [this message]
2026-09-24 10:44 ` Sabrina Dubroca
2026-09-08 6:49 ` [PATCH ipsec v2 2/6] xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state() Antony Antony
2026-09-08 6:49 ` [PATCH ipsec v2 3/6] xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path Antony Antony
2026-09-08 6:49 ` [PATCH ipsec v2 4/6] xfrm: include mark in MIGRATE_STATE SA collision check Antony Antony
2026-09-08 6:49 ` [PATCH ipsec v2 5/6] xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state() Antony Antony
2026-09-08 6:49 ` [PATCH ipsec v2 6/6] docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple Antony Antony
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=arGTH94PM_oswTpF@bern \
--to=root@bern \
--cc=antony.antony@secunet.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=evitayan@google.com \
--cc=fw@strlen.de \
--cc=hadi@cyberus.ca \
--cc=herbert@gondor.apana.org.au \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sd@queasysnail.net \
--cc=shuah@kernel.org \
--cc=steffen.klassert@secunet.com \
--cc=tobias@strongswan.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox