Re: [PATCH][IPv6][IPsec] fix the address family for xfrm_state_lookup in xfrm_input

Herbert Xu wrote:

On Tue, Dec 04, 2007 at 02:28:36PM +0900, Kazunori MIYAZAWA wrote:

quoted

Hi Herbert, 

This is the patch to fix IPv6 IPsec input.

Signed-off-by: Kazunori MIYAZAWA <redacted>

Good catch! Thanks.

quoted

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 96f42c1..da3c963 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c

@@ -136,7 +136,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 		if (skb->sp->len == XFRM_MAX_DEPTH)
 			goto drop;
 
-		x = xfrm_state_lookup(daddr, spi, nexthdr, AF_INET);
+		x = xfrm_state_lookup(daddr, spi, nexthdr, skb->dst->ops->family);

I'd prefer to put this in XFRM_SPI_SKB_CB instead because the xfrm
layer shouldn't really rely on dst->ops structures except on entry
and exit, like this:

[IPSEC]: Use the correct family for input state lookup

When merging the input paths of IPsec I accidentally left a hard-coded
AF_INET for the state lookup call.  This broke IPv6 obviously.  This
patch fixes by getting the input callers to specify the family through
skb->cb.

Credit goes to Kazunori Miyazawa for diagnosing this and providing an
initial patch.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,

It works fine.

Thank you!!

--
Kazunori Miyazawa