Re: [PATCH 3/3 XFRM]: Fix invalid key for lookup of cached bundles

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Mon, Mar 07, 2005 at 02:41:30AM +0100, Patrick McHardy wrote:
> >
> >Actually, why do we need to treat tunnel mode differently here?
> >In other words, why not just do the mark/tos checks unconditionally.
> 
> Mainly to avoid excessive long lists of cached bundles in tunnel
> mode. The use of a single list for the cache is questionable, but
> the patch was supposed to fix a different issue. Restricting use
> of tos/mark to transport mode avoids having exploding lists that
> are easily remotely triggerable.

That's a different problem.  You can already create arbitrarily
long bundle lists by spoofing src/dst addresses...

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt