Re: [PATCH 2.6]: Check against correct policy list in ip_forward/ip6_forward

[Patrick McHardy <kaber@xxxxxxxxx>]

Herbert Xu wrote:

> Well it's too late to change the default policy.  People rely on the
> default policy being allow so changing it will wreak havoc.  Even if
> you do it only for packets with an IPsec encapsulation by checking
> skb->sp it may still break people who use manual keying and rely on
> the property that you can always add optional SAs.
You're right.

>  More importantly that it'll stick out like a sore thumb in terms of
> its semantics.

__xfrm_policy_check already rejects packets without a matching policy
and skb->sp set, but it is skipped while the policy list is empty.
What, from a semantics point of view, would be wrong with making
xfrm_policy_check behave the same way ?

> So let's just fix racoon.
Agreed. I have a patch I'm currently testing. Judging from a quick
grep isakmpd also doesn't add forward policies.

Regards
Patrick