[XFRM] STATE: Allow non IPsec protocol.

It will be added two more transformation protocols (routing header
and destination options header) for Mobile IPv6.
xfrm_id_proto_match() can be handle zero as all, IPSEC_PROTO_ANY as
all IPsec and otherwise as exact one.
Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 5b364b0a6a2812d7b97628ff6886baf2ce47ad01..2a7d2132a1ae553320c79506fa74d956c4f9070d 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -838,7 +838,10 @@ static inline int xfrm_state_kern(struct xfrm_state *x)
 
 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
 {
-       return (userproto == IPSEC_PROTO_ANY || proto == userproto);
+       return (!userproto || proto == userproto ||
+               (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
+                                                 proto == IPPROTO_ESP ||
+                                                 proto == IPPROTO_COMP)));
 }
 
 /*

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 0d580ac1977158f71c2cc656f19183516ba6ff86..41f3d51ffc332f626023ec3486d299c42b0fff49 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -542,7 +542,7 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
        info.nlmsg_flags = NLM_F_MULTI;
        info.this_idx = 0;
        info.start_idx = cb->args[0];
-       (void) xfrm_state_walk(IPSEC_PROTO_ANY, dump_one_state, &info);
+       (void) xfrm_state_walk(0, dump_one_state, &info);
        cb->args[0] = info.this_idx;
 
        return skb->len;