|
 |
0ac2f3 |
From 7c1351ea866ec811ade4452b5f1791b34b0effe3 Mon Sep 17 00:00:00 2001
|
|
|
0ac2f3 |
From: Andrea Claudi <aclaudi@redhat.com>
|
|
|
0ac2f3 |
Date: Thu, 16 Apr 2020 12:10:23 +0200
|
|
|
0ac2f3 |
Subject: [PATCH] xfrm: not try to delete ipcomp states when using deleteall
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1808634
|
|
|
0ac2f3 |
Upstream Status: iproute2.git commit f9d696cf414c2
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
commit f9d696cf414c2c475764aa3b29cf288350f1e21f
|
|
|
0ac2f3 |
Author: Xin Long <lucien.xin@gmail.com>
|
|
|
0ac2f3 |
Date: Mon Feb 24 09:57:01 2020 -0500
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
xfrm: not try to delete ipcomp states when using deleteall
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
In kernel space, ipcomp(sub) states used by main states are not
|
|
|
0ac2f3 |
allowed to be deleted by users, they would be freed only when
|
|
|
0ac2f3 |
all main states are destroyed and no one uses them.
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
In user space, ip xfrm sta deleteall doesn't filter these ipcomp
|
|
|
0ac2f3 |
states out, and it causes errors:
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
# ip xfrm state add src 192.168.0.1 dst 192.168.0.2 spi 0x1000 \
|
|
|
0ac2f3 |
proto comp comp deflate mode tunnel sel src 192.168.0.1 dst \
|
|
|
0ac2f3 |
192.168.0.2 proto gre
|
|
|
0ac2f3 |
# ip xfrm sta deleteall
|
|
|
0ac2f3 |
Failed to send delete-all request
|
|
|
0ac2f3 |
: Operation not permitted
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
This patch is to fix it by filtering ipcomp states with a check
|
|
|
0ac2f3 |
xsinfo->id.proto == IPPROTO_IPIP.
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
Fixes: c7699875bee0 ("Import patch ipxfrm-20040707_2.diff")
|
|
|
0ac2f3 |
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
|
|
0ac2f3 |
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
|
|
|
0ac2f3 |
---
|
|
|
0ac2f3 |
ip/xfrm_state.c | 3 +++
|
|
|
0ac2f3 |
1 file changed, 3 insertions(+)
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
|
|
|
0ac2f3 |
index 7b413cd9b9a22..d014444e9af4f 100644
|
|
|
0ac2f3 |
--- a/ip/xfrm_state.c
|
|
|
0ac2f3 |
+++ b/ip/xfrm_state.c
|
|
|
0ac2f3 |
@@ -1131,6 +1131,9 @@ static int xfrm_state_keep(struct nlmsghdr *n, void *arg)
|
|
|
0ac2f3 |
if (!xfrm_state_filter_match(xsinfo))
|
|
|
0ac2f3 |
return 0;
|
|
|
0ac2f3 |
|
|
|
0ac2f3 |
+ if (xsinfo->id.proto == IPPROTO_IPIP)
|
|
|
0ac2f3 |
+ return 0;
|
|
|
0ac2f3 |
+
|
|
|
0ac2f3 |
if (xb->offset > xb->size) {
|
|
|
0ac2f3 |
fprintf(stderr, "State buffer overflow\n");
|
|
|
0ac2f3 |
return -1;
|
|
|
0ac2f3 |
--
|
|
|
0ac2f3 |
2.25.4
|
|
|
0ac2f3 |
|