Re: xfrm: Pass on correct AF value to xfrm_state_find

On Thu, Feb 16, 2023 at 04:01:21PM +0530, Sri Sakthi wrote:

IP compression enabled flow uses 2 xfrms, a tunnel mode SA followed by a
transport mode SA like the sample ip x p pasted below,

src 10.171.96.0/20 dst 10.171.80.0/20

dir out priority 379519

tmpl src 2b01:7660:6:c::aab:1c7 dst 2b01:7660:6:c::aab:30

proto comp reqid 4 mode tunnel

tmpl src :: dst ::

  ^^^^^^^^^^^^^^^^^^ should be IPv4

proto esp reqid 4 mode transport

This looks like a configuration error to me.  You are first
compressing the packet, which occurs in tunnel mode, and that's
the point where your IPv4 packet becomes IPv6.  So everything
beyond this should be IPv6.

You then apply ESP to the IPv6 packet.  So the ESP SA/policy
should be v6/v6.

However, the policy selector for the ESP transform should still
be IPv4.  This is because the policy selector on a nested policy
is matched against the inner-most flow, and not one level below
(don't ask me why, it was this way before I got here :)

In your case your ESP policy selector says that it has to be IPv6,
while the inner-most flow is IPv4.  That's why it doesn't work.

Cheers,
-- 
Email: Herbert Xu [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt