netdev - pull request (net): ipsec 2022-01-06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Jan 2022 10:36:00 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
CC:     Herbert Xu <herbert@...dor.apana.org.au>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        <netdev@...r.kernel.org>
Subject: pull request (net): ipsec 2022-01-06

1) Fix xfrm policy lookups for ipv6 gre packets by initializing
   fl6_gre_key properly. From Ghalem Boudour.

2) Fix the dflt policy check on forwarding when there is no
   policy configured. The check was done for the wrong direction.
   From Nicolas Dichtel.

3) Use the correct 'struct xfrm_user_offload' when calculating
   netlink message lenghts in xfrm_sa_len(). From Eric Dumazet.

4) Tread inserting xfrm interface id 0 as an error.
   From Antony Antony.

5) Fail if xfrm state or policy is inserted with XFRMA_IF_ID 0,
   xfrm interfaces with id 0 are not allowed.
   From Antony Antony.

6) Fix inner_ipproto setting in the sec_path for tunnel mode.
   From  Raed Salem.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 03a000bfd7193cacefb40e309283578c6ae207b5:

  Merge branch 'nh-group-refcnt' (2021-11-22 15:44:49 +0000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git master

for you to fetch changes up to 45a98ef4922def8c679ca7c454403d1957fe70e7:

  net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path (2022-01-05 10:59:35 +0100)

----------------------------------------------------------------
Antony Antony (2):
      xfrm: interface with if_id 0 should return error
      xfrm: state and policy should fail if XFRMA_IF_ID 0

Eric Dumazet (1):
      xfrm: fix a small bug in xfrm_sa_len()

Ghalem Boudour (1):
      xfrm: fix policy lookup for ipv6 gre packets

Nicolas Dichtel (1):
      xfrm: fix dflt policy check when there is no policy configured

Raed Salem (1):
      net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path

 include/net/xfrm.h        |  2 +-
 net/ipv6/ip6_gre.c        |  5 ++++-
 net/xfrm/xfrm_interface.c | 14 ++++++++++++--
 net/xfrm/xfrm_output.c    | 30 +++++++++++++++++++++++++-----
 net/xfrm/xfrm_policy.c    | 21 +++++++++++++++++++++
 net/xfrm/xfrm_user.c      | 23 +++++++++++++++++++----
 6 files changed, 82 insertions(+), 13 deletions(-)