mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-28 14:44:10 +08:00
ipsec-2024-03-06
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmXoPHUACgkQrB3Eaf9P W7ehmxAAoemzwIDP0wcDi7U68Za7wBC7CbV6WoVmDNRsO+BwnqlCtd7+B9hi0Qd0 h+KCVYw5EbUJbsHcuefj/QMNO46ueZZLswRIEMKlkZOHdC8TTGzjYmjLnkOHKTCm wpJ9QSrnBoy3MUcWbZCJh4BZXsTftbu1fHRWy9GdBERXYfHqWdQCq/ZMAgv3IwLF KwZahoGZwCDkmWOpshbBRGj0lnONzZ3mW//bN5EB71rSi33gPEtABYBSw9E9sdMw uZg/xRnHMhS5CQHRnFEqVUiqu3wDJYgs3kQIDFhC1T2w94GBF/R+HzzFiBKLzxr1 Dk17avoNexSYRThJfCk6fMbXT4GVaUSKSG6KI4CRLna/wAIb4QEVDPEdk1ybOxRy eoUfo7GXkVqhJpqnOX0Sl3262DnhQ/syhmv3sWXmoSpa630mDuFleVuVJE81dtMu jSfaXY7BNpEwTwj8kzabKq5cLkt4T4dAnXf0ao1ATNCzcFkUjSIWN5ylnOEtdVe/ wEZYp8oc1kPEDU0RC8LzpaEooTQlPceeIAZca7a/lAhnRreGyP9j56Y2oM9YS76o JPRrznWAdXVa0gX81zGOjZDHWSyLgpJZ9z5MaAdquP9uhXS4buu+pxxoUcFEfLJd FV+yY9j3o3l0HLL6j/y6EZy/QzWPV+K9NAhokNL/WTwuOZ2Lq5Y= =FnLp -----END PGP SIGNATURE----- Merge tag 'ipsec-2024-03-06' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2024-03-06 1) Clear the ECN bits flowi4_tos in decode_session4(). This was already fixed but the bug was reintroduced when decode_session4() switched to us the flow dissector. From Guillaume Nault. 2) Fix UDP encapsulation in the TX path with packet offload mode. From Leon Romanovsky, 3) Avoid clang fortify warning in copy_to_user_tmpl(). From Nathan Chancellor. 4) Fix inter address family tunnel in packet offload mode. From Mike Yu. * tag 'ipsec-2024-03-06' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: set skb control buffer based on packet offload as well xfrm: fix xfrm child route lookup for packet offload xfrm: Avoid clang fortify warning in copy_to_user_tmpl() xfrm: Pass UDP encapsulation in TX packet offload xfrm: Clear low order bits of ->flowi4_tos in decode_session4(). ==================== Link: https://lore.kernel.org/r/20240306100438.3953516-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
commit
811b3f9b2a
@ -407,7 +407,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
|
||||
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
||||
struct net_device *dev = x->xso.dev;
|
||||
|
||||
if (!x->type_offload || x->encap)
|
||||
if (!x->type_offload)
|
||||
return false;
|
||||
|
||||
if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET ||
|
||||
|
@ -704,9 +704,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
|
||||
{
|
||||
struct net *net = dev_net(skb_dst(skb)->dev);
|
||||
struct xfrm_state *x = skb_dst(skb)->xfrm;
|
||||
int family;
|
||||
int err;
|
||||
|
||||
switch (x->outer_mode.family) {
|
||||
family = (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) ? x->outer_mode.family
|
||||
: skb_dst(skb)->ops->family;
|
||||
|
||||
switch (family) {
|
||||
case AF_INET:
|
||||
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
|
||||
IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
|
||||
|
@ -2694,7 +2694,9 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
|
||||
if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
|
||||
mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
|
||||
|
||||
family = xfrm[i]->props.family;
|
||||
if (xfrm[i]->xso.type != XFRM_DEV_OFFLOAD_PACKET)
|
||||
family = xfrm[i]->props.family;
|
||||
|
||||
oif = fl->flowi_oif ? : fl->flowi_l3mdev;
|
||||
dst = xfrm_dst_lookup(xfrm[i], tos, oif,
|
||||
&saddr, &daddr, family, mark);
|
||||
@ -3416,7 +3418,7 @@ decode_session4(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve
|
||||
}
|
||||
|
||||
fl4->flowi4_proto = flkeys->basic.ip_proto;
|
||||
fl4->flowi4_tos = flkeys->ip.tos;
|
||||
fl4->flowi4_tos = flkeys->ip.tos & ~INET_ECN_MASK;
|
||||
}
|
||||
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
|
@ -2017,6 +2017,9 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
|
||||
if (xp->xfrm_nr == 0)
|
||||
return 0;
|
||||
|
||||
if (xp->xfrm_nr > XFRM_MAX_DEPTH)
|
||||
return -ENOBUFS;
|
||||
|
||||
for (i = 0; i < xp->xfrm_nr; i++) {
|
||||
struct xfrm_user_tmpl *up = &vec[i];
|
||||
struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
|
||||
|
Loading…
Reference in New Issue
Block a user