From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755261Ab3BFOaT (ORCPT ); Wed, 6 Feb 2013 09:30:19 -0500 Received: from mail-ie0-f169.google.com ([209.85.223.169]:48211 "EHLO mail-ie0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753825Ab3BFOaQ (ORCPT ); Wed, 6 Feb 2013 09:30:16 -0500 Message-ID: <511268F0.5070808@mojatatu.com> Date: Wed, 06 Feb 2013 09:30:08 -0500 From: Jamal Hadi Salim User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130106 Thunderbird/17.0.2 MIME-Version: 1.0 To: Emmanuel Thierry CC: Steffen Klassert , Romain KUNTZ , "netdev@vger.kernel.org" , "davem@davemloft.net" , herbert@gondor.hengli.com.au, "linux-kernel@vger.kernel.org" , Jamal Hadi Salim Subject: Re: [RFC PATCH] xfrm: fix handling of XFRM policies mark and mask. References: <9E57ADA1-5770-47A8-8EBF-7FC262EEF1C7@ipflavors.com> <20130205081232.GF23291@secunet.com> <51125744.3030905@gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 13-02-06 08:53 AM, Emmanuel Thierry wrote: > Actually, we didn't think about this problem since we work with priorities, putting the default policy (without a mark) at a minor priority than the marked one. I think priorities are the way to go in cases of ambiguity. > Your remark makes clearer the ideas behind the design of XFRM, but this leads to an interesting concern. If on policy insertion, the policy were inserted depending on the accuracy of the mark (the more the mask is specific, the more the mark must be put at the beginning of the list), how would we decide which is the more specific between these ones ? > > ip -6 xfrm policy add src fd00::1/128 dst fd00::2/128 dir out mark 0x00000001 mask 0x00000005 > > ip -6 xfrm policy add src fd00::1/128 dst fd00::2/128 dir out mark 0x00000001 mask 0x00000003 They look different to me, no? i.e i dont see a conflict - one has mark=5 and the other has mark=3. cheers, jamal