Re: [PATCH 2.6]: Check against correct policy list in ip_forward/ip6_forward

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:

>
>Well it's too late to change the default policy.  People rely on the
>default policy being allow so changing it will wreak havoc.  Even if
>you do it only for packets with an IPsec encapsulation by checking
>skb->sp it may still break people who use manual keying and rely on
>the property that you can always add optional SAs.
>
You're right.

>  More importantly that it'll stick out like a sore thumb in terms of
>
 > its semantics.

__xfrm_policy_check already rejects packets without a matching policy
and skb->sp set, but it is skipped while the policy list is empty.
What, from a semantics point of view, would be wrong with making
xfrm_policy_check behave the same way ?

>
>So let's just fix racoon.
>
Agreed. I have a patch I'm currently testing. Judging from a quick
grep isakmpd also doesn't add forward policies.

Regards
Patrick