Tobias Brunner 6ac400b7c5 xfrm: Fix inbound traffic via XFRM interfaces across network namespaces ... [ Upstream commit 660899ddf0 ] After moving an XFRM interface to another namespace it stays associated with the original namespace (net in `struct xfrm_if` and the list keyed with `xfrmi_net_id`), allowing processes in the new namespace to use SAs/policies that were created in the original namespace. For instance, this allows a keying daemon in one namespace to establish IPsec SAs for other namespaces without processes there having access to the keys or IKE credentials. This worked fine for outbound traffic, however, for inbound traffic the lookup for the interfaces and the policies used the incorrect namespace (the one the XFRM interface was moved to). Fixes: f203b76d78 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Tobias Brunner <tobias@strongswan.org> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-03-23 20:09:49 +01:00
..
Kconfig	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-07-27 09:33:37 -07:00
Makefile	xfrm: Add virtual xfrm interfaces	2018-06-23 16:07:25 +02:00
xfrm_algo.c	xfrm: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
xfrm_device.c	xfrm: don't check offload_handle for nonzero	2018-07-19 10:18:04 +02:00
xfrm_hash.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_hash.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_input.c	xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.	2019-01-13 09:50:57 +01:00
xfrm_interface.c	xfrm: Fix inbound traffic via XFRM interfaces across network namespaces	2019-03-23 20:09:49 +01:00
xfrm_ipcomp.c	net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()	2018-03-13 07:46:37 +01:00
xfrm_output.c	xfrm: Fix error return code in xfrm_output_one()	2019-01-13 09:50:57 +01:00
xfrm_policy.c	xfrm: Fix inbound traffic via XFRM interfaces across network namespaces	2019-03-23 20:09:49 +01:00
xfrm_proc.c	proc: introduce proc_create_net_single	2018-05-16 07:24:30 +02:00
xfrm_replay.c	xfrm: Fix ESN sequence number handling for IPsec GSO packets.	2018-03-01 08:14:50 +01:00
xfrm_state.c	xfrm: Fix bucket count reported to userspace	2019-01-13 09:50:57 +01:00
xfrm_sysctl.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_user.c	xfrm: refine validation of template and selector families	2019-02-15 08:10:13 +01:00