From: Martin Bouzek <martin.bouzek@radas-atc.cz>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>,
davem@davemloft.net, netdev@oss.sgi.com
Subject: Re: Minor IPSec bug + solution
Date: 20 Sep 2004 09:49:49 +0200 [thread overview]
Message-ID: <1095666589.2723.8.camel@mabouzek> (raw)
In-Reply-To: <20040917102720.GA14579@gondor.apana.org.au>
On Fri, 2004-09-17 at 12:27, Herbert Xu wrote:
> On Fri, Sep 17, 2004 at 11:26:13AM +0200, Martin Bouzek wrote:
> >
> > > > function. For tunnels it returns
> > > >
> > > > tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, family);
> >
> > Well, I am not expierienced with the networking kernel code,
> > nevertheless I still think the check is not correct.
>
> If you change the && to ||, then an ESP tunnel SA marked as required
> can be matched by a simple IPIP SA with the same addresses.
Ok. And would it be possible to check the protocols too (eg.
tmpl->id.proto == x->id.proto)? If it is realy not possible to make the
IPComp/required tunnel to work, it would be nice to mention it in for
example the setkey man page. It could save quite lot of time to some
people. (like me :-) ).
next prev parent reply other threads:[~2004-09-20 7:49 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1095327372.4466.87.camel@mabouzek>
2004-09-16 21:19 ` Minor IPSec bug + solution Herbert Xu
2004-09-17 9:26 ` Martin Bouzek
2004-09-17 10:27 ` Herbert Xu
2004-09-20 7:49 ` Martin Bouzek [this message]
2004-09-20 10:57 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1095666589.2723.8.camel@mabouzek \
--to=martin.bouzek@radas-atc.cz \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).