From: Anthony DeRossi <ajderossi@gmail.com>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: netdev@vger.kernel.org, steffen.klassert@secunet.com,
davem@davemloft.net, kuba@kernel.org
Subject: Re: [PATCH ipsec] xfrm: Pass template address family to xfrm_state_look_at
Date: Tue, 3 Nov 2020 07:16:00 -0800 [thread overview]
Message-ID: <CAKkLME25zc21fvc_fatae-Lmzzr2sQfbNkqWSENGfoHa4rJpoQ@mail.gmail.com> (raw)
In-Reply-To: <20201103120839.GA10834@gondor.apana.org.au>
On Tue, Nov 3, 2020 at 4:08 AM Herbert Xu <herbert@gondor.apana.org.au> wrote:
>
> On Mon, Nov 02, 2020 at 06:32:19PM -0800, Anthony DeRossi wrote:
> > This fixes a regression where valid selectors are incorrectly skipped
> > when xfrm_state_find is called with a non-matching address family (e.g.
> > when using IPv6-in-IPv4 ESP in transport mode).
>
> Why are we even allowing v6-over-v4 in transport mode? Isn't that
> the whole point of BEET mode?
I'm not sure. This is the outgoing policy that strongSwan creates for
an IPv6-in-IPv4 tunnel when compression is enabled:
src fd02::/16 dst fd02::2/128
dir out priority 326271 ptype main
tmpl src 10.0.0.8 dst 192.168.1.231
proto comp spi 0x0000d00e reqid 1 mode tunnel
tmpl src 0.0.0.0 dst 0.0.0.0
proto esp spi 0xc543e950 reqid 1 mode transport
After your patch, outgoing IPv6 packets fail to match the associated state:
src 10.0.0.8 dst 192.168.1.231
proto esp spi 0xc543e950 reqid 1 mode transport
replay-window 0
auth-trunc hmac(sha256)
0x143b570f59b23eaa560905f19a922451c6dfa5694ba2e45e1b065bb1863421aa 128
enc cbc(aes) 0x526ed144ca087125ce30e36c8f20d972
encap type espinudp sport 4501 dport 4500 addr 0.0.0.0
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 0.0.0.0/0 dst 0.0.0.0/0
Is this an invalid configuration?
Anthony
prev parent reply other threads:[~2020-11-03 15:17 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-03 2:32 [PATCH ipsec] xfrm: Pass template address family to xfrm_state_look_at Anthony DeRossi
2020-11-03 12:05 ` Herbert Xu
2020-11-03 15:03 ` Anthony DeRossi
2020-11-03 12:08 ` Herbert Xu
2020-11-03 15:16 ` Anthony DeRossi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKkLME25zc21fvc_fatae-Lmzzr2sQfbNkqWSENGfoHa4rJpoQ@mail.gmail.com \
--to=ajderossi@gmail.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).