aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMasahide NAKAMURA <nakam@linux-ipv6.org>2006-08-23 21:00:48 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-09-22 18:06:38 -0400
commitf3bd484021d9486b826b422a017d75dd0bd258ad (patch)
tree52ec4e50183dffc02d33bd3cfcafe4cbc2022910
parent1d71627d699eca831c1fbfb66ea67bb1fba41415 (diff)
[XFRM]: Restrict authentication algorithm only when inbound transformation protocol is IPsec.
For Mobile IPv6 usage, routing header or destination options header is used and it doesn't require this comparison. It is checked only for IPsec template. Based on MIPL2 kernel patch. Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/xfrm/xfrm_policy.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a0d58971391d..f1cdcfb90959 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1004,7 +1004,8 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
1004 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && 1004 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
1005 (x->props.reqid == tmpl->reqid || !tmpl->reqid) && 1005 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
1006 x->props.mode == tmpl->mode && 1006 x->props.mode == tmpl->mode &&
1007 (tmpl->aalgos & (1<<x->props.aalgo)) && 1007 ((tmpl->aalgos & (1<<x->props.aalgo)) ||
1008 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
1008 !(x->props.mode != XFRM_MODE_TRANSPORT && 1009 !(x->props.mode != XFRM_MODE_TRANSPORT &&
1009 xfrm_state_addr_cmp(tmpl, x, family)); 1010 xfrm_state_addr_cmp(tmpl, x, family));
1010} 1011}