• Xin Long's avatar
    xfrm: policy: match with both mark and mask on user interfaces · 4f47e8ab
    Xin Long authored
    In commit ed17b8d3 ("xfrm: fix a warning in xfrm_policy_insert_list"),
    it would take 'priority' to make a policy unique, and allow duplicated
    policies with different 'priority' to be added, which is not expected
    by userland, as Tobias reported in strongswan.
    
    To fix this duplicated policies issue, and also fix the issue in
    commit ed17b8d3 ("xfrm: fix a warning in xfrm_policy_insert_list"),
    when doing add/del/get/update on user interfaces, this patch is to change
    to look up a policy with both mark and mask by doing:
    
      mark.v == pol->mark.v && mark.m == pol->mark.m
    
    and leave the check:
    
      (mark & pol->mark.m) == pol->mark.v
    
    for tx/rx path only.
    
    As the userland expects an exact mark and mask match to manage policies.
    
    v1->v2:
      - make xfrm_policy_mark_match inline and fix the changelog as
        Tobias suggested.
    
    Fixes: 295fae56 ("xfrm: Allow user space manipulation of SPD mark")
    Fixes: ed17b8d3 ("xfrm: fix a warning in xfrm_policy_insert_list")
    Reported-by: default avatarTobias Brunner <tobias@strongswan.org>
    Tested-by: default avatarTobias Brunner <tobias@strongswan.org>
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    4f47e8ab
af_key.c 101 KB