Re: [PATCH v5 ipsec-next] xfrm: introduce forwarding of ICMP Error messages

Steffen Klassert
2024-01-04T09:49:39Z

On Fri, Dec 22, 2023 at 01:57:04PM +0100, Antony Antony wrote:
> +
> int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
> unsigned short family)
> {
> @@ -3549,9 +3672,17 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
>
> for (i = sp->len - 1; i >= 0; i--) {
> struct xfrm_state *x = sp->xvec[i];
> + int ret = 0;
> +
> if (!xfrm_selector_match(&x->sel, &fl, family)) {
> - XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH);
> - return 0;
> + ret = true;
> + if (x->props.flags & XFRM_STATE_ICMP &&
> + xfrm_selector_inner_icmp_match(skb, family, &x->sel, &fl))
> + ret = false;

__xfrm_policy_check returns int, not bool. Please fix these
return values.