netdev - Re: [PATCH ipsec] xfrm: Honor original L3 slave device in xfrmi policy lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190329072226.GS25855@gauss3.secunet.de>
Date:   Fri, 29 Mar 2019 08:22:26 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Martin Willi <martin@...ongswan.org>
CC:     Tobias Brunner <tobias@...ongswan.org>,
        David Ahern <dsa@...ulusnetworks.com>, <netdev@...r.kernel.org>
Subject: Re: [PATCH ipsec] xfrm: Honor original L3 slave device in xfrmi
 policy lookup

On Tue, Mar 26, 2019 at 01:20:43PM +0100, Martin Willi wrote:
> If an xfrmi is associated to a vrf layer 3 master device,
> xfrm_policy_check() fails after traffic decapsulation. The input
> interface is replaced by the layer 3 master device, and hence
> xfrmi_decode_session() can't match the xfrmi anymore to satisfy
> policy checking.
> 
> Extend ingress xfrmi lookup to honor the original layer 3 slave
> device, allowing xfrm interfaces to operate within a vrf domain.
> 
> Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
> Signed-off-by: Martin Willi <martin@...ongswan.org>

Applied, thanks a lot Martin!