Re: [XFRM] Allow transport SAs even when there is no policy

["David S. Miller" <davem@xxxxxxxxxxxxx>]

On Tue, 19 Oct 2004 07:43:26 +1000
Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> wrote:

> On Mon, Oct 18, 2004 at 10:34:23PM +0200, Patrick McHardy wrote:
> > 
> > > More importantly that it'll stick out like a sore thumb in terms of
> > >
> > > its semantics.
> > 
> > __xfrm_policy_check already rejects packets without a matching policy
> > and skb->sp set, but it is skipped while the policy list is empty.
> > What, from a semantics point of view, would be wrong with making
> > xfrm_policy_check behave the same way ?
> 
> Good catch.  That was a bug introduced by yours truly :)
> 
> What I meant to say is all packets with tunnel mode SAs should be
> rejected since we don't allow optional tunnel transforms for security
> reasons.
> 
> This patch fixes it.
> 
> Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>

Applied, thanks Herbert.