* [PATCH iproute2] xfrm: not try to delete ipcomp states when using deleteall
@ 2020-02-24 14:57 Xin Long
2020-02-28 21:51 ` Stephen Hemminger
0 siblings, 1 reply; 3+ messages in thread
From: Xin Long @ 2020-02-24 14:57 UTC (permalink / raw)
To: network dev; +Cc: stephen, steffen.klassert, sd
In kernel space, ipcomp(sub) states used by main states are not
allowed to be deleted by users, they would be freed only when
all main states are destroyed and no one uses them.
In user space, ip xfrm sta deleteall doesn't filter these ipcomp
states out, and it causes errors:
# ip xfrm state add src 192.168.0.1 dst 192.168.0.2 spi 0x1000 \
proto comp comp deflate mode tunnel sel src 192.168.0.1 dst \
192.168.0.2 proto gre
# ip xfrm sta deleteall
Failed to send delete-all request
: Operation not permitted
This patch is to fix it by filtering ipcomp states with a check
xsinfo->id.proto == IPPROTO_IPIP.
Fixes: c7699875bee0 ("Import patch ipxfrm-20040707_2.diff")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
ip/xfrm_state.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index f2727070..428a5837 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -1131,6 +1131,9 @@ static int xfrm_state_keep(struct nlmsghdr *n, void *arg)
if (!xfrm_state_filter_match(xsinfo))
return 0;
+ if (xsinfo->id.proto == IPPROTO_IPIP)
+ return 0;
+
if (xb->offset > xb->size) {
fprintf(stderr, "State buffer overflow\n");
return -1;
--
2.18.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH iproute2] xfrm: not try to delete ipcomp states when using deleteall
2020-02-24 14:57 [PATCH iproute2] xfrm: not try to delete ipcomp states when using deleteall Xin Long
@ 2020-02-28 21:51 ` Stephen Hemminger
2020-02-29 4:03 ` Xin Long
0 siblings, 1 reply; 3+ messages in thread
From: Stephen Hemminger @ 2020-02-28 21:51 UTC (permalink / raw)
To: Xin Long; +Cc: network dev, steffen.klassert, sd
On Mon, 24 Feb 2020 09:57:01 -0500
Xin Long <lucien.xin@gmail.com> wrote:
> In kernel space, ipcomp(sub) states used by main states are not
> allowed to be deleted by users, they would be freed only when
> all main states are destroyed and no one uses them.
>
> In user space, ip xfrm sta deleteall doesn't filter these ipcomp
> states out, and it causes errors:
>
> # ip xfrm state add src 192.168.0.1 dst 192.168.0.2 spi 0x1000 \
> proto comp comp deflate mode tunnel sel src 192.168.0.1 dst \
> 192.168.0.2 proto gre
> # ip xfrm sta deleteall
> Failed to send delete-all request
> : Operation not permitted
>
> This patch is to fix it by filtering ipcomp states with a check
> xsinfo->id.proto == IPPROTO_IPIP.
>
> Fixes: c7699875bee0 ("Import patch ipxfrm-20040707_2.diff")
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Wow that has been broken for a long time, does anyone use this?
Applied
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH iproute2] xfrm: not try to delete ipcomp states when using deleteall
2020-02-28 21:51 ` Stephen Hemminger
@ 2020-02-29 4:03 ` Xin Long
0 siblings, 0 replies; 3+ messages in thread
From: Xin Long @ 2020-02-29 4:03 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: network dev, Steffen Klassert, Sabrina Dubroca
On Sat, Feb 29, 2020 at 5:51 AM Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> On Mon, 24 Feb 2020 09:57:01 -0500
> Xin Long <lucien.xin@gmail.com> wrote:
>
> > In kernel space, ipcomp(sub) states used by main states are not
> > allowed to be deleted by users, they would be freed only when
> > all main states are destroyed and no one uses them.
> >
> > In user space, ip xfrm sta deleteall doesn't filter these ipcomp
> > states out, and it causes errors:
> >
> > # ip xfrm state add src 192.168.0.1 dst 192.168.0.2 spi 0x1000 \
> > proto comp comp deflate mode tunnel sel src 192.168.0.1 dst \
> > 192.168.0.2 proto gre
> > # ip xfrm sta deleteall
> > Failed to send delete-all request
> > : Operation not permitted
> >
> > This patch is to fix it by filtering ipcomp states with a check
> > xsinfo->id.proto == IPPROTO_IPIP.
> >
> > Fixes: c7699875bee0 ("Import patch ipxfrm-20040707_2.diff")
> > Signed-off-by: Xin Long <lucien.xin@gmail.com>
>
>
> Wow that has been broken for a long time, does anyone use this?
I don't know, it was just found in our testcase.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-02-29 4:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-02-24 14:57 [PATCH iproute2] xfrm: not try to delete ipcomp states when using deleteall Xin Long
2020-02-28 21:51 ` Stephen Hemminger
2020-02-29 4:03 ` Xin Long
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).