Re: [Vpn-failover] [RFC] IPSEC failover - Netlink part

[Patrick McHardy <kaber@xxxxxxxxx>]

Ulrich Weber wrote:

> what did you mean with "leaks xfrm_state reference"? The missing
> xfrm_state_put(x) ?
Yes.

> I changed it (see below) to use Krisztian's xfrm_state_replay_update 
> function.
Even better.

> |> static const int xfrm_msg_min[(XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)] = {
> |>     NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)),    /* NEW SA */
> |>     NLMSG_LENGTH(sizeof(struct xfrm_usersa_id)),    /* DEL SA */
> |> @@ -867,6 +897,7 @@
> |>     NLMSG_LENGTH(sizeof(struct xfrm_user_polexpire)), /* POLEXPIRE */
> |>     NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush)),    /* FLUSH SA */
> |>     NLMSG_LENGTH(0),                /* FLUSH POLICY */
> |> +    NLMSG_LENGTH(sizeof(struct xfrm_usersa_id)),/* UPD SEQ */
> |>
> |>
> | ^^ what about struct xfrm_replay_state ?
> it's attached as rt attribute, so it should be ok.

But you don't check it's size. You need to include it here or check it
when you use it.

Regards
Patrick