dlan17/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfrm: Honor original L3 slave device in xfrmi policy lookup

Browse Source 
If an xfrmi is associated to a vrf layer 3 master device,
xfrm_policy_check() fails after traffic decapsulation. The input
interface is replaced by the layer 3 master device, and hence
xfrmi_decode_session() can't match the xfrmi anymore to satisfy
policy checking.

Extend ingress xfrmi lookup to honor the original layer 3 slave
device, allowing xfrm interfaces to operate within a vrf domain.

Fixes: f203b76d78 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Martin Willi
2019-03-27 16:14:05 +01:00
committed by Steffen Klassert
parent 8dfb4eba41
commit 025c65e119
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/net/xfrm.h
+2 -1
View File
@@ -295,7 +295,8 @@ struct xfrm_replay {
};
struct xfrm_if_cb {
struct xfrm_if *(*decode_session)(struct sk_buff *skb);
struct xfrm_if *(*decode_session)(struct sk_buff *skb,
unsigned short family);
};
void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);