iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Fix XFRM-I support for nested ESP tunnels"

Browse Source 
This reverts commit b0355dbbf1.

The reverted commit clears the secpath on packets received via xfrm interfaces
to support nested IPsec tunnels. This breaks Netfilter policy matching using
xt_policy in the FORWARD chain, as the secpath is missing during forwarding.
Additionally, Benedict Wong reports that it breaks Transport-in-Tunnel mode.

Fix this regression by reverting the commit until we have a better approach
for nested IPsec tunnels.

Fixes: b0355dbbf1 ("Fix XFRM-I support for nested ESP tunnels")
Link: https://lore.kernel.org/netdev/20230412085615.124791-1-martin@strongswan.org/
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Martin Willi
2023-04-25 09:46:18 +02:00
committed by Steffen Klassert
parent ec8f32ad9a
commit 5fc46f9421
2 changed files with 4 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/xfrm/xfrm_policy.c
View File

@ -3739,9 +3739,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
goto reject;
}
if (if_id)
secpath_reset(skb);
xfrm_pols_put(pols, npols);
return 1;
}