Skip to content
  • Fan Du's avatar
    xfrm: check user specified spi for IPComp · ea9884b3
    Fan Du authored
    
    
    IPComp connection between two hosts is broken if given spi bigger
    than 0xffff.
    
    OUTSPI=0x87
    INSPI=0x11112
    
    ip xfrm policy update dst 192.168.1.101 src 192.168.1.109 dir out action allow \
           tmpl dst 192.168.1.101 src 192.168.1.109 proto comp spi $OUTSPI
    ip xfrm policy update src 192.168.1.101 dst 192.168.1.109 dir in action allow \
           tmpl src 192.168.1.101 dst 192.168.1.109 proto comp spi $INSPI
    
    ip xfrm state add src 192.168.1.101 dst 192.168.1.109  proto comp spi $INSPI \
    		comp deflate
    ip xfrm state add dst 192.168.1.101 src 192.168.1.109  proto comp spi $OUTSPI \
    		comp deflate
    
    tcpdump can capture outbound ping packet, but inbound packet is
    dropped with XfrmOutNoStates errors. It looks like spi value used
    for IPComp is expected to be 16bits wide only.
    
    Signed-off-by: default avatarFan Du <fan.du@windriver.com>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    ea9884b3