On Tue, Dec 26, 2017 at 05:34:44PM +1100, Herbert Xu wrote: > Currently we allow state updates to competely replace the contents > of x->encap. This is bad because on the user side ESP only sets up > header lengths depending on encap_type once when the state is first > created. This could result in the header lengths getting out of > sync with the actual state configuration. > > In practice key managers will never do a state update to change the > encapsulation type. Only the port numbers need to be changed as the > peer NAT entry is updated. > > Therefore this patch adds a check in xfrm_state_update to forbid > any changes to the encap_type. > > Signed-off-by: Herbert Xu <herb...@gondor.apana.org.au>
Applied to the ipsec tree, thanks Herbert!
