On Fri, Jan 05, 2018 at 10:12:32PM +1100, Herbert Xu wrote:
> On Fri, Jan 05, 2018 at 09:32:47AM +0100, Steffen Klassert wrote:
> >
> > Looks like we catch the unknown mode in __xfrm_init_state().
> > But in any case, if we want to return -EINVAL on unknown mode,
> > we should do it for IPv6 and for IPv4.
>
> OK, how about this one then:
>
> ---8<---
> Currently esp will happily create an xfrm state with an unknown
> encap type for IPv4, without setting the necessary state parameters.
> This patch fixes it by returning -EINVAL.
>
> There is a similar problem in IPv6 where if the mode is unknown
> we will skip initialisation while returning zero. However, this
> is harmless as the mode has already been checked further up the
> stack. This patch removes this anomaly by aligning the IPv6
> behaviour with IPv4 and treating unknown modes (which cannot
> actually happen) as transport mode.
>
> Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP")
> Signed-off-by: Herbert Xu <[email protected]>
Patch applied, thanks Herbert!
