From: Masahide NAKAMURA <[EMAIL PROTECTED]>
On current kernel inbound transformation state is allowed transport and
disallowed tunnel mode when mismatch is occurred between tempates and states.
As the result of adding two more modes by Mobile IPv6, this function name
is misleading. Inbound transformation can allow only transport mode
when mismatch is occurred between template and secpath.
Based on MIPL2 kernel patch.
Signed-off-by: Masahide NAKAMURA <[EMAIL PROTECTED]>
Signed-off-by: YOSHIFUJI Hideaki <[EMAIL PROTECTED]>
---
net/xfrm/xfrm_policy.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 66cd501..f91cf69 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1046,7 +1046,7 @@ xfrm_decode_session(struct sk_buff *skb,
}
EXPORT_SYMBOL(xfrm_decode_session);
-static inline int secpath_has_tunnel(struct sec_path *sp, int k)
+static inline int secpath_has_nontransport(struct sec_path *sp, int k)
{
for (; k < sp->len; k++) {
if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT)
@@ -1087,7 +1087,7 @@ int __xfrm_policy_check(struct sock *sk,
xfrm_policy_lookup);
if (!pol)
- return !skb->sp || !secpath_has_tunnel(skb->sp, 0);
+ return !skb->sp || !secpath_has_nontransport(skb->sp, 0);
pol->curlft.use_time = (unsigned long)xtime.tv_sec;
@@ -1111,7 +1111,7 @@ int __xfrm_policy_check(struct sock *sk,
goto reject;
}
- if (secpath_has_tunnel(sp, k))
+ if (secpath_has_nontransport(sp, k))
goto reject;
xfrm_pol_put(pol);
--
1.4.0
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
