Re: [PATCH net-next] xfrm: rework default policy structure

Le 19/11/2021 à 16:41, Leon Romanovsky a écrit :
[snip]

quoted

What about:

static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
                                         int dir)
{
        if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
                return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;

        return false;
}

It is much better, just extra "!" is not in place.

Ok, I will send a v2 with that.

if (!net->xfrm.policy_count[dir] ... -> if (net->xfrm.policy_count[dir] ...

Hmm, are you sure?
If "there is no policy configured" and "there is no secpath"
  then "return the default policy"

The original statement is:
       if (xfrm_default_allow(net, dir))
               return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ||
                      (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
                      __xfrm_policy_check(sk, ndir, skb, family);

Thank you,
Nicolas