Benedict Wong 1f8b6df6a9 xfrm: Treat already-verified secpath entries as optional ... This change allows inbound traffic through nested IPsec tunnels to successfully match policies and templates, while retaining the secpath stack trace as necessary for netfilter policies. Specifically, this patch marks secpath entries that have already matched against a relevant policy as having been verified, allowing it to be treated as optional and skipped after a tunnel decapsulation (during which the src/dst/proto/etc may have changed, and the correct policy chain no long be resolvable). This approach is taken as opposed to the iteration in b0355dbbf1, where the secpath was cleared, since that breaks subsequent validations that rely on the existence of the secpath entries (netfilter policies, or transport-in-tunnel mode, where policies remain resolvable). Fixes: b0355dbbf1 ("Fix XFRM-I support for nested ESP tunnels") Test: Tested against Android Kernel Unit Tests Test: Tested against Android CTS Signed-off-by: Benedict Wong <benedictwong@google.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2023-05-21 09:21:37 +02:00
..
espintcp.c	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
Kconfig
Makefile	xfrm: interface: Add unstable helpers for setting/getting XFRM metadata from TC-BPF	2022-12-05 21:58:27 -08:00
xfrm_algo.c
xfrm_compat.c	xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()	2023-01-23 07:44:09 +01:00
xfrm_device.c	ipsec-2023-05-16	2023-05-16 20:52:35 -07:00
xfrm_hash.c
xfrm_hash.h
xfrm_inout.h
xfrm_input.c	xfrm: Treat already-verified secpath entries as optional	2023-05-21 09:21:37 +02:00
xfrm_interface_bpf.c	bpf: Add __bpf_kfunc tag to all kfuncs	2023-02-02 00:25:14 +01:00
xfrm_interface_core.c	Revert "Fix XFRM-I support for nested ESP tunnels"	2023-04-25 09:50:34 +02:00
xfrm_ipcomp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
xfrm_output.c	xfrm: Remove inner/outer modes from output path	2023-03-13 11:51:13 +01:00
xfrm_policy.c	xfrm: Treat already-verified secpath entries as optional	2023-05-21 09:21:37 +02:00
xfrm_proc.c
xfrm_replay.c	xfrm: replay: Fix ESN wrap around for GSO	2022-10-19 09:00:53 +02:00
xfrm_state.c	Extend packet offload to fully support libreswan	2023-03-22 21:56:33 -07:00
xfrm_sysctl.c
xfrm_user.c	ipsec-2023-05-16	2023-05-16 20:52:35 -07:00