On Mon, Jul 27, 2020 at 04:03:47PM +0200, Sabrina Dubroca wrote:
> commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset
> computation") changed esp6_input_done2 to correctly find the size of
> the IPv6 header that precedes the TCP/UDP encapsulation header, but
> didn't adjust the final call to skb_set_transport_header, which I
> assumed was correct in using skb_network_header_len.
>
> Xiumei Mu reported that when we create xfrm states that include port
> numbers in the selector, traffic from the user sockets is dropped. It
> turns out that we get a state mismatch in __xfrm_policy_check, because
> we end up trying to compare the encapsulation header's ports with the
> selector that's based on user traffic ports.
>
> Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP")
> Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp")
> Reported-by: Xiumei Mu <x...@redhat.com>
> Signed-off-by: Sabrina Dubroca <s...@queasysnail.net>
Applied, thanks a lot Sabrina!
