From 40dda2fc9fb2597996e443117df18995c58444a9 Mon Sep 17 00:00:00 2001 From: Andrea Claudi Date: Thu, 30 Apr 2020 12:46:30 +0200 Subject: [PATCH] xfrm: also check for ipv6 state in xfrm_state_keep Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1828033 Upstream Status: iproute2.git commit d27fc6390ce32 commit d27fc6390ce32ecdba6324e22b1c341791c5c63f Author: Xin Long Date: Mon Apr 27 15:14:24 2020 +0800 xfrm: also check for ipv6 state in xfrm_state_keep As commit f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall") does, this patch is to fix the same issue for ip6 state where xsinfo->id.proto == IPPROTO_IPV6. # ip xfrm state add src 2000::1 dst 2000::2 spi 0x1000 \ proto comp comp deflate mode tunnel sel src 2000::1 dst \ 2000::2 proto gre # ip xfrm sta deleteall Failed to send delete-all request : Operation not permitted Note that the xsinfo->proto in common states can never be IPPROTO_IPV6. Fixes: f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall") Reported-by: Xiumei Mu Signed-off-by: Xin Long Acked-by: Andrea Claudi Signed-off-by: Stephen Hemminger --- ip/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index d014444e9af4f..44f08ceed24dd 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -1131,7 +1131,8 @@ static int xfrm_state_keep(struct nlmsghdr *n, void *arg) if (!xfrm_state_filter_match(xsinfo)) return 0; - if (xsinfo->id.proto == IPPROTO_IPIP) + if (xsinfo->id.proto == IPPROTO_IPIP || + xsinfo->id.proto == IPPROTO_IPV6) return 0; if (xb->offset > xb->size) { -- 2.25.4