On Fri, Jul 24, 2020 at 04:46:07PM +0200, Sabrina Dubroca wrote: > Currently, any UDP-encapsulated packet of 8 bytes or less will be > passed to userspace, whether it starts with the non-ESP prefix or > not (except keepalives). This includes: > - messages of 1, 2, 3 bytes > - messages of 4 to 8 bytes not starting with 00 00 00 00 > > This patch changes that behavior, so that only properly-formed non-ESP > messages are passed to userspace. Messages of 8 bytes or less that > don't contain a full non-ESP prefix followed by some data (at least > one byte) will be dropped and counted as XfrmInHdrError.
I'm ok with that change. But it affects userspace, so the *swan people have to tell if that's ok for them.
