Steve Hill wrote:
then the ESP SA is added and it has the same sequence number (1) as the
AH SA so the AH SA gets deleted.
The xfrm_state_add() function does:
x1 = __xfrm_find_acq_byseq(x->km.seq);
...
xfrm_state_delete(x1);
And this is responsible for deleting the AH SA due to it's matching
sequence number.
This is a bug in the kernel, __xfrm_find_acq_byseq should only return
XFRM_STATE_ACQ states. This patch should fix it.
Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
===== net/xfrm/xfrm_state.c 1.55 vs edited =====
--- 1.55/net/xfrm/xfrm_state.c 2005-03-07 06:23:53 +01:00
+++ edited/net/xfrm/xfrm_state.c 2005-03-08 18:42:13 +01:00
@@ -609,7 +609,7 @@
for (i = 0; i < XFRM_DST_HSIZE; i++) {
list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
- if (x->km.seq == seq) {
+ if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
xfrm_state_hold(x);
return x;
}
|