Re: [PATCH ipsec v2 1/6] xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups

[Sabrina Dubroca <sd@queasysnail.net>]

(sorry, this got caught by my mail provider's spam filter so I only
saw it today)

2026-09-21, 22:27:11 +0200, root wrote:
> On Mon, Sep 21, 2026 at 03:28:10PM +0200, Sabrina Dubroca wrote:
> > 2026-09-08, 08:48:45 +0200, Antony Antony wrote:
> > > Add __xfrm_state_lookup_exact(); wire it into DELSA/GETSA
> > 
> > On the "other proto" branch of xfrm_user_state_lookup(), we call
> > xfrm_state_lookup_byaddr() -> __xfrm_state_lookup_byaddr(), which
> > still does a "loose" mark match:
> > 
> > 		if ((mark & x->mark.m) != x->mark.v)
> > 			continue;
> > 
> > Is that ok?
> 
> I think so. I felt byaddr is not used and aslo since there is no unique spi
> if touch it dragons may wake up:) most used cases with SPI.

Ok.

> > That's the only thing I've noticed in the series.
> > 
> > 
> > I guess someone could claim that this patch changes behavior, but if a
> > user somewhere notices it, I think that would mean they were relying
> > on insertion order to delete/etc the right SA.
> 
> yes that is a risk. I tried find use cases and got nowhere. 
> And concluded it was an oversight. Also note the
> cover letter, "policy" had similar change a while ago.
> No one complained yet?

Yeah, I agree. Just maybe worth mentioning briefly in the commit
message, and adding a reference the policy patch.

-- 
Sabrina