Re: [PATCH ipsec] xfrm: Pass template address family to xfrm_state_look_at
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2020-11-03 12:08:45
On Mon, Nov 02, 2020 at 06:32:19PM -0800, Anthony DeRossi wrote:
This fixes a regression where valid selectors are incorrectly skipped when xfrm_state_find is called with a non-matching address family (e.g. when using IPv6-in-IPv4 ESP in transport mode).
Why are we even allowing v6-over-v4 in transport mode? Isn't that the whole point of BEET mode? Cheers, -- Email: Herbert Xu [off-list ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt