Re: [PATCH 0/18] pull request (net-next): ipsec-next 2026-06-12

[Antony Antony <antony@phenome.org>]

On Sat, Jun 13, 2026 at 01:15:52PM -0700, Jakub Kicinski wrote:
> On Fri, 12 Jun 2026 09:46:16 +0200 Steffen Klassert wrote:
> > 3) Add a new netlink message XFRM_MSG_MIGRATE_STATE that
> >    allows migrating individual IPsec SAs independently of
> >    their policies. The existing XFRM_MSG_MIGRATE is tightly coupled
> >    to policy+SA migration, lacks SPI for unique SA identification,
> >    and cannot express reqid changes or migrate Transport mode
> >    selectors. The new interface identifies the SA via SPI and mark,
> >    supports reqid changes, address family changes, encap removal,
> >    and uses an atomic create+install flow under x->lock to prevent
> >    SN/IV reuse during AEAD SA migration.
> >    From Antony Antony.
> 
> Hi! There are some Sashiko comments here, please follow up:
> 
> https://sashiko.dev/#/patchset/20260612074725.1760473-8-steffen.klassert@secunet.com
> 

Thanks Jakub. I have fixes and testing them now. And I will send fixes soon.

The comments didn't click until I realized xfrm_user_state_lookup() only
keys on mark.v & mark.m, so distinct (v, m) pairs collapse to the same
masked value. A lookup key of {0, 0} matches a source SA with mark
{0, 0xffffff} (both mask to 0), but reusing {0, 0} as the migrated mark 
turns "match only mark 0x00" into "match all traffic".

Fix is copy from old SA than from old_mark passed along. This also pointed 
more issues.

-antony