linux

iv/linux

History

Tobias Brunner 660899ddf0 xfrm: Fix inbound traffic via XFRM interfaces across network namespaces

After moving an XFRM interface to another namespace it stays associated
with the original namespace (net in `struct xfrm_if` and the list keyed
with `xfrmi_net_id`), allowing processes in the new namespace to use
SAs/policies that were created in the original namespace.  For instance,
this allows a keying daemon in one namespace to establish IPsec SAs for
other namespaces without processes there having access to the keys or IKE
credentials.

This worked fine for outbound traffic, however, for inbound traffic the
lookup for the interfaces and the policies used the incorrect namespace
(the one the XFRM interface was moved to).

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

2019-02-18 10:58:54 +01:00

Kconfig

xfrm: prefer secpath_set over secpath_dup

2018-12-19 11:21:38 -08:00

Makefile

xfrm: Add virtual xfrm interfaces

2018-06-23 16:07:25 +02:00

xfrm_algo.c

xfrm: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:11 -07:00

xfrm_device.c

net: use skb_sec_path helper in more places