| Message ID | 0cafbebeba54747b04a72d0fc06aa2ad569f3739.1680613644.git.sd@queasysnail.net (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [ipsec] xfrm: don't check the default policy if the policy allows the packet | expand |
On Tue, Apr 04, 2023 at 03:12:16PM +0200, Sabrina Dubroca wrote: > The current code doesn't let a simple "allow" policy counteract a > default policy blocking all incoming packets: > > ip x p setdefault in block > ip x p a src 192.168.2.1/32 dst 192.168.2.2/32 dir in action allow > > At this stage, we have an allow policy (with or without transforms) > for this packet. It doesn't matter what the default policy says, since > the policy we looked up lets the packet through. The case of a > blocking policy is already handled separately, so we can remove this > check. > > Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") > Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Applied, thanks a lot Sabrina!
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 5c61ec04b839..62be042f2ebc 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3712,12 +3712,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, } xfrm_nr = ti; - if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK && - !xfrm_nr) { - XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); - goto reject; - } - if (npols > 1) { xfrm_tmpl_sort(stp, tpp, xfrm_nr, family); tpp = stp;
The current code doesn't let a simple "allow" policy counteract a default policy blocking all incoming packets: ip x p setdefault in block ip x p a src 192.168.2.1/32 dst 192.168.2.2/32 dir in action allow At this stage, we have an allow policy (with or without transforms) for this packet. It doesn't matter what the default policy says, since the policy we looked up lets the packet through. The case of a blocking policy is already handled separately, so we can remove this check. Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> --- net/xfrm/xfrm_policy.c | 6 ------ 1 file changed, 6 deletions(-)