From 98ad13988375d240d6446954355da9622b87f1c1 Mon Sep 17 00:00:00 2001
From: Andrea Claudi <aclaudi@redhat.com>
Date: Thu, 30 Apr 2020 19:50:12 +0200
Subject: [PATCH] xfrm: also check for ipv6 state in xfrm_state_keep

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1828034
Upstream Status: iproute2.git commit d27fc6390ce32

commit d27fc6390ce32ecdba6324e22b1c341791c5c63f
Author: Xin Long <lucien.xin@gmail.com>
Date:   Mon Apr 27 15:14:24 2020 +0800

    xfrm: also check for ipv6 state in xfrm_state_keep

    As commit f9d696cf414c ("xfrm: not try to delete ipcomp states when using
    deleteall") does, this patch is to fix the same issue for ip6 state where
    xsinfo->id.proto == IPPROTO_IPV6.

      # ip xfrm state add src 2000::1 dst 2000::2 spi 0x1000 \
        proto comp comp deflate mode tunnel sel src 2000::1 dst \
        2000::2 proto gre
      # ip xfrm sta deleteall
      Failed to send delete-all request
      : Operation not permitted

    Note that the xsinfo->proto in common states can never be IPPROTO_IPV6.

    Fixes: f9d696cf414c ("xfrm: not try to delete ipcomp states when using deleteall")
    Reported-by: Xiumei Mu <xmu@redhat.com>
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Andrea Claudi <aclaudi@redhat.com>
    Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 ip/xfrm_state.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index 8baa0eb669969..e0e24b0618294 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -1048,7 +1048,8 @@ static int xfrm_state_keep(const struct sockaddr_nl *who,
 	if (!xfrm_state_filter_match(xsinfo))
 		return 0;
 
-	if (xsinfo->id.proto == IPPROTO_IPIP)
+	if (xsinfo->id.proto == IPPROTO_IPIP ||
+	    xsinfo->id.proto == IPPROTO_IPV6)
 		return 0;
 
 	if (xb->offset > xb->size) {
-- 
2.25.4