mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/xfrm
History
Benedict Wong a287f5b0cf xfrm: Ensure policies always checked on XFRM-I input path 
This change adds methods in the XFRM-I input path that ensures that
policies are checked prior to processing of the subsequent decapsulated
packet, after which the relevant policies may no longer be resolvable
(due to changing src/dst/proto/etc).

Notably, raw ESP/AH packets did not perform policy checks inherently,
whereas all other encapsulated packets (UDP, TCP encapsulated) do policy
checks after calling xfrm_input handling in the respective encapsulation
layer.

Fixes: b0355dbbf1 ("Fix XFRM-I support for nested ESP tunnels")
Test: Verified with additional Android Kernel Unit tests
Test: Verified against Android CTS
Signed-off-by: Benedict Wong <benedictwong@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2023-05-21 09:21:37 +02:00
..
espintcp.c net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
Kconfig
Makefile xfrm: interface: Add unstable helpers for setting/getting XFRM metadata from TC-BPF 2022-12-05 21:58:27 -08:00
xfrm_algo.c
xfrm_compat.c xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() 2023-01-23 07:44:09 +01:00
xfrm_device.c ipsec-2023-05-16 2023-05-16 20:52:35 -07:00
xfrm_hash.c
xfrm_hash.h
xfrm_inout.h
xfrm_input.c xfrm: Treat already-verified secpath entries as optional 2023-05-21 09:21:37 +02:00
xfrm_interface_bpf.c bpf: Add __bpf_kfunc tag to all kfuncs 2023-02-02 00:25:14 +01:00
xfrm_interface_core.c xfrm: Ensure policies always checked on XFRM-I input path 2023-05-21 09:21:37 +02:00
xfrm_ipcomp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-10-03 17:44:18 -07:00
xfrm_output.c xfrm: Remove inner/outer modes from output path 2023-03-13 11:51:13 +01:00
xfrm_policy.c xfrm: Treat already-verified secpath entries as optional 2023-05-21 09:21:37 +02:00
xfrm_proc.c
xfrm_replay.c xfrm: replay: Fix ESN wrap around for GSO 2022-10-19 09:00:53 +02:00
xfrm_state.c Extend packet offload to fully support libreswan 2023-03-22 21:56:33 -07:00
xfrm_sysctl.c
xfrm_user.c ipsec-2023-05-16 2023-05-16 20:52:35 -07:00