Commit 7833aa05 authored by Steffen Klassert's avatar Steffen Klassert Committed by David S. Miller

xfrm: Check for the new replay implementation if an esn state is inserted

IPsec extended sequence numbers can be used only with the new
anti-replay window implementation. So check if the new implementation
is used if an esn state is inserted and return an error if it is not.
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c0a56e64
...@@ -124,6 +124,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p, ...@@ -124,6 +124,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
{ {
struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
if ((p->flags & XFRM_STATE_ESN) && !rt)
return -EINVAL;
if (!rt) if (!rt)
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment