Benedict Wong 0b892d8fe9 Fix XFRM-I support for nested ESP tunnels ... [ Upstream commit b0355dbbf1 ] This change adds support for nested IPsec tunnels by ensuring that XFRM-I verifies existing policies before decapsulating a subsequent policies. Addtionally, this clears the secpath entries after policies are verified, ensuring that previous tunnels with no-longer-valid do not pollute subsequent policy checks. This is necessary especially for nested tunnels, as the IP addresses, protocol and ports may all change, thus not matching the previous policies. In order to ensure that packets match the relevant inbound templates, the xfrm_policy_check should be done before handing off to the inner XFRM protocol to decrypt and decapsulate. Notably, raw ESP/AH packets did not perform policy checks inherently, whereas all other encapsulated packets (UDP, TCP encapsulated) do policy checks after calling xfrm_input handling in the respective encapsulation layer. Test: Verified with additional Android Kernel Unit tests Signed-off-by: Benedict Wong <benedictwong@google.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-03 11:52:20 +01:00
..
6lowpan	…
9p	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	…
appletalk	…
atm	net/atm: fix proc_mpc_write incorrect return value	2022-10-15 11:08:36 +01:00
ax25	…
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-09-22 13:02:10 -07:00
bluetooth	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
bpf	bpf: Move skb->len == 0 checks into __bpf_redirect	2022-12-31 13:32:14 +01:00
bpfilter	…
bridge	netfilter: br_netfilter: disable sabotage_in hook after first suppression	2023-02-09 11:28:08 +01:00
caif	caif: fix memory leak in cfctrl_linkup_request()	2023-01-12 12:02:33 +01:00
can	can: j1939: do not wait 250 ms if the same addr was already claimed	2023-02-14 19:11:42 +01:00
ceph	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
core	net: Fix unwanted sign extension in netdev_stats_to_stats64()	2023-02-22 12:59:50 +01:00
dcb	…
dccp	dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.	2023-02-22 12:59:52 +01:00
dns_resolver	…
dsa	net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path	2022-12-31 13:32:29 +01:00
ethernet	…
ethtool	net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats	2023-01-24 07:24:31 +01:00
hsr	hsr: Synchronize sequence number updates.	2022-12-31 13:32:22 +01:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife	…
ipv4	txhash: fix sk->sk_txrehash default	2023-02-14 19:11:48 +01:00
ipv6	ipv6: Fix tcp socket connection with DSCP.	2023-02-22 12:59:54 +01:00
iucv	…
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	xfrm: Fix oops in __xfrm_state_delete()	2022-11-22 07:14:55 +01:00
l2tp	l2tp: prevent lockdep issue in l2tp_tunnel_register()	2023-02-01 08:34:24 +01:00
l3mdev	…
lapb	…
llc	…
mac80211	mac80211: Fix MLO address translation for multiple bss case	2023-02-06 08:06:31 +01:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	net: mctp: purge receive queues on sk destruction	2023-02-06 08:06:34 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:59:53 +01:00
mptcp	mptcp: fix locking for in-kernel listener creation	2023-02-22 12:59:40 +01:00
ncsi	…
netfilter	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
netlabel	…
netlink	netlink: annotate data races around sk_state	2023-02-01 08:34:45 +01:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-02-09 11:28:06 +01:00
nfc	net: nfc: Fix use-after-free in local_cleanup()	2023-02-01 08:34:17 +01:00
nsh	…
openvswitch	net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()	2023-02-22 12:59:52 +01:00
packet	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE	2022-11-29 08:30:18 -08:00
phonet	…
psample	…
qrtr	net: qrtr: free memory on error path in radix_tree_insert()	2023-02-09 11:28:15 +01:00
rds	rds: rds_rm_zerocopy_callback() use list_first_entry()	2023-02-14 19:11:48 +01:00
rfkill	…
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:59:42 +01:00
rxrpc	rxrpc: Fix missing unlock in rxrpc_do_sendmsg()	2022-12-31 13:32:55 +01:00
sched	net: sched: sch: Fix off by one in htb_activate_prios()	2023-02-22 12:59:56 +01:00
sctp	sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list	2023-02-22 12:59:51 +01:00
smc	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
strparser	…
sunrpc	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
switchdev	…
tipc	tipc: fix kernel warning when sending SYN message	2023-02-22 12:59:53 +01:00
tls	net/tls: tls_is_tx_ready() checked list_entry	2023-02-09 11:28:08 +01:00
unix	unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg()	2022-12-31 13:32:54 +01:00
vmw_vsock	net: vmw_vsock: vmci: Check memcpy_from_msg()	2022-12-31 13:32:26 +01:00
wireless	wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails	2022-12-31 13:32:20 +01:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:28:13 +01:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
xfrm	Fix XFRM-I support for nested ESP tunnels	2023-03-03 11:52:20 +01:00
Kconfig	…
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	…
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c	…
socket.c	net: use a bounce buffer for copying skb->mark	2023-02-22 12:59:53 +01:00
sysctl_net.c	…