Herbert Xu wrote:
Well it's too late to change the default policy. People rely on the
default policy being allow so changing it will wreak havoc. Even if
you do it only for packets with an IPsec encapsulation by checking
skb->sp it may still break people who use manual keying and rely on
the property that you can always add optional SAs.
You're right.
More importantly that it'll stick out like a sore thumb in terms of
> its semantics.
__xfrm_policy_check already rejects packets without a matching policy
and skb->sp set, but it is skipped while the policy list is empty.
What, from a semantics point of view, would be wrong with making
xfrm_policy_check behave the same way ?
So let's just fix racoon.
Agreed. I have a patch I'm currently testing. Judging from a quick
grep isakmpd also doesn't add forward policies.
Regards
Patrick
|