From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dmitry Safonov Subject: Re: [PATCH] net/xfrm: Fix lookups for states with spi == 0 Date: Wed, 02 May 2018 13:41:36 +0100 Message-ID: <1525264896.14025.23.camel@arista.com> References: <20180502020220.2027-1-dima@arista.com> <20180502091125.jnzaaazh67z4ihyf@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: linux-kernel@vger.kernel.org, 0x7f454c46@gmail.com, Steffen Klassert , "David S. Miller" , netdev@vger.kernel.org To: Herbert Xu Return-path: In-Reply-To: <20180502091125.jnzaaazh67z4ihyf@gondor.apana.org.au> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Wed, 2018-05-02 at 17:11 +0800, Herbert Xu wrote: > On Wed, May 02, 2018 at 03:02:20AM +0100, Dmitry Safonov wrote: > > It seems to be a valid use case to add xfrm state without > > Security Parameter Indexes (SPI) value associated: > > ip xfrm state add src $src dst $dst proto $proto mode $mode sel src > > $src dst $dst $algo > > > > The bad thing is that it's currently impossible to get/delete the > > state > > without SPI: __xfrm_state_insert() obviously doesn't add hash for > > zero > > SPI in xfrm.state_byspi, and xfrm_user_state_lookup() will fail as > > xfrm_state_lookup() does lookups by hash. > > > > It also isn't possible to workaround from userspace as > > xfrm_id_proto_match() will be always true for ah/esp/comp protos. > > > > So, don't try looking up by hash if SPI == 0. > > > > Cc: Steffen Klassert > > Cc: Herbert Xu > > Cc: "David S. Miller" > > Cc: netdev@vger.kernel.org > > Signed-off-by: Dmitry Safonov > > A zero SPI is illegal for many IPsec protocols because that value > is used for other purposes, e.g., IKE encapsulation. But still it's possible to create ipsec with zero SPI. And it seems not making sense to search for a state with SPI hash if request has zero SPI. -- Dima