Commit 7833aa05 authored Apr 25, 2011 by Steffen Klassert Committed by David S. Miller Apr 26, 2011

xfrm: Check for the new replay implementation if an esn state is inserted



IPsec extended sequence numbers can be used only with the new
anti-replay window implementation. So check if the new implementation
is used if an esn state is inserted and return an error if it is not.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c0a56e64

net/xfrm/xfrm_user.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -124,6 +124,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
		{
		struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];

		if ((p->flags & XFRM_STATE_ESN) && !rt)
		return -EINVAL;

		if (!rt)
		return 0;