Re: [PATCH v2 ipsec-next] xfrm: Add possibility to set the default to block if we have no policy

On Sun, Jul 18, 2021 at 09:11:06AM +0200, Antony Antony wrote:

From: Steffen Klassert <steffen.klassert@secunet.com>

As the default we assume the traffic to pass, if we have no
matching IPsec policy. With this patch, we have a possibility to
change this default from allow to block. It can be configured
via netlink. Each direction (input/output/forward) can be
configured separately. With the default to block configuered,
we need allow policies for all packet flows we accept.
We do not use default policy lookup for the loopback device.

v1->v2
 - fix compiling when XFRM is disabled
 - Reported-by: kernel test robot [off-list ref]

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Co-developed-by: Christian Langrock <redacted>
Signed-off-by: Christian Langrock <redacted>
Co-developed-by: Antony Antony <redacted>
Signed-off-by: Antony Antony <redacted>

Applied, thanks for pushing this upstream Antony!