On Thu, Sep 22, 2022 at 06:33:55PM -0700, Benedict Wong wrote:

Ahh, I've never had an IPv4 server without a NAT to test against, I'd presume
this is identical there. The only comparison that I've been able to do  was IPv4
UDP-encap vs IPv6 ESP.

We could instead add the policy check to the ESP input path if that is
the correct place.

Ok, looks like there is a policy check missing for xfrm_interfaces
when already one (or more) transformations happened.

The best would be to add a separate xfrm_interfaces rcv handler
(in struct xfrm6_protocol/xfrm4_protocol) for esp4/6 and do
the policy check if we have a secpath present.

That should fix it in combination with reseting the secpath in
the policy_check as I did in my previous patch.