On Thu, Mar 21, 2019 at 9:11 PM Herbert Xu <herb...@gondor.apana.org.au> wrote: > > On Thu, Mar 21, 2019 at 09:06:05PM -0700, Cong Wang wrote: > > > > Good point. Replacing IPSEC_PROTO_ANY with zero should > > work too, but on the other hand, id.proto is still never allowed to > > be any other protocol than these 6 listed, no? > > It should never be IPSEC_PROTO_ANY since that's used as a wildcard. > > IOW if you're going to tighten up the check for the id.proto filed > in an actual state, you should distinguish between the case of an > ID that's used to add/modify a state vs. an ID that's be used to > query a state. IPSEC_PROTO_ANY and zero should be denied in the > first case and allowed in the second case.
Yeah, this makes sense. Let me see if I can figure this out correctly. Thanks for the details!
