Re: [PATCH 2/3] XFRM: RFC4303 compliant auditing

From: Paul Moore <paul.moore(a)hp.com&gt; Date: Thu, 20 Dec 2007 16:42:25 -0500 > This patch adds a number of new IPsec audit events to meet the auditing > requirements of RFC4303. This includes audit hooks for the following > events: > > * Could not find a valid SA [sections 2.1, 3.4.2] > . xfrm_audit_state_notfound() > . xfrm_audit_state_notfound_simple() > > * Sequence number overflow [section 3.3.3] > . xfrm_audit_state_replay_overflow() > > * Replayed packet [section 3.4.3] > . xfrm_audit_state_replay() > > * Integrity check failure [sections 3.4.4.1, 3.4.4.2] > . xfrm_audit_state_icvfail() > > While RFC4304 deals only with ESP most of the changes in this patch apply > to IPsec in general, i.e. both AH and ESP. The one case, integrity check > failure, where ESP specific code had to be modified the same was done to > the AH code for the sake of consistency. > > Signed-off-by: Paul Moore <paul.moore(a)hp.com&gt; This doesn't apply at all to net-2.6.25, in particular xfrm6_input_addr() doesn't even have a local variable named "xfrm_vec_one" let alone the conditional where you're adding the state notfound audit hook. Please respin this and the third patch, thanks.