Re: [PATCH ipsec v3 0/6] xfrm: state: exact mark/mask match for control-plane SA lookups

[Antony Antony <antony@phenome.org>]

On Thu, Sep 24, 2026 at 12:57:05PM +0200, Sabrina Dubroca wrote:
> 2026-09-21, 22:43:59 +0200, Antony Antony wrote:
..

> The series looks good, but why did you remove the selftests you had in v1?

> https://lore.kernel.org/all/migrate-state-fixes-v0-3-a69e8637ba3b@secunet.com/

Thanks for the review. sorry for late response.

The selftests were in v1; I dropped them from v2 on. I should have
mentiond it in change log! I used the tests to find unusual mark configurations,
ones that strongSwan would not set.
As far as I know these are unlikely, or plain misconfigurations: several
SAs with the same (SPI, daddr, proto) that differ only in mark, where
the SA a lookup finds depends on the order they were inserted in.

I did not post the script with the fixes: the tests got complicated,
and XFRM_MSG_MIGRATE* is not supported in iproute2. Adding those tests
would make the already big series even bigger and risk a long review
loop.

After v3, working on the fixes also reveled further problems with
misconfigured marks, such as bits outside the mask (0x10001/0xf), in both states and
policies. The kernel quietly sanitized them away on insert, so a later
exact lookup, e.g. delete, could not find the SA. The extra patches in
v4 and v5 address this. Android's test suite is good at catching such
misconfigurations, and Yan helped me there.

I could send the selftests separately as a follow-up after this series.

-antony