Patrick McHardy wrote:
quoted text > Patrick McHardy wrote:
> > Patrick McHardy wrote:
> >> The problem appears to be that openswan doesn't initialize the
> >> selectors family when adding new SAs. xfrm_init_state() uses
> >> the family to decide whether to set up inter family SAs or
> >> regular SAs. We used to fix up the family in xfrm_user, but
> >> this is now only done for transport mode SAs.
> >>
> >> - /*
> >> - * Set inner address family if the KM left it as zero.
> >> - * See comment in validate_tmpl.
> >> - */
> >> - if (!x->sel.family)
> >> + if (x->props.mode == XFRM_MODE_TRANSPORT)
> >> x->sel.family = p->family;
> >> +
> >>
> >> Reverting this part should fix it, but would break inter family
> >> tunnels again. It seems we need a different indication for
> >> xfrm_init_state() for inter family SAs.
> >>
> >> Kazunori, any ideas?
> >
> >
> > Did you have a chance to look into this? This is most likely
> > going to break a lot of setups, so a fix is really needed
> > before 2.6.25 is released.
>
> <sigh>
>
> Marco, could you test this patch please?
[sorry for the huge delay]
Openswan is happy with this patch. I have tested
openswan 2.4.12 with linux 2.6.25-rc9
Thanks for fixing this issue before 2.6.25 final.
------------------------------------------------------------------------
--------
quoted text > commit 712e842d9d39b21da439c043242d8863a8eca7a3
> Author: Patrick McHardy <kaber@trash.net>
> Date: Wed Apr 9 15:25:45 2008 +0200
>
> [XFRM]: xfrm_user: fix selector family initialization
>
> Commit df9dcb45 ([IPSEC]: Fix inter address family IPsec tunnel
handling)
quoted text > broke openswan by removing the selector initialization for tunnel
mode
quoted text > in case it is uninitialized.
>
> This patch restores the initialization, fixing openswan, but
probably
quoted text > breaking inter-family tunnels again (unknown since the patch
author
quoted text > disappeared). The correct thing for inter-family tunnels is
probably
quoted text > to simply initialize the selector family explicitly.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
>
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index 5d96f27..019d21d 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -288,7 +288,7 @@ static void copy_from_user_state(struct xfrm_state
*x, struct xfrm_usersa_info *
quoted text > memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
> x->props.flags = p->flags;
>
> - if (x->props.mode == XFRM_MODE_TRANSPORT)
> + if (!x->sel.family)
> x->sel.family = p->family;
>
> }
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
majordomo@vger.kernel.org
More majordomo info at
http://vger.kernel.org/majordomo-info.html
