linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-24 12:31:04 -05:00

Files

Martin Willi 025c65e119 xfrm: Honor original L3 slave device in xfrmi policy lookup

If an xfrmi is associated to a vrf layer 3 master device,
xfrm_policy_check() fails after traffic decapsulation. The input
interface is replaced by the layer 3 master device, and hence
xfrmi_decode_session() can't match the xfrmi anymore to satisfy
policy checking.

Extend ingress xfrmi lookup to honor the original layer 3 slave
device, allowing xfrm interfaces to operate within a vrf domain.

Fixes: f203b76d78 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

2019-03-27 16:14:05 +01:00

Kconfig

xfrm: prefer secpath_set over secpath_dup

2018-12-19 11:21:38 -08:00

Makefile

xfrm: Add virtual xfrm interfaces

2018-06-23 16:07:25 +02:00

xfrm_algo.c

xfrm: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:11 -07:00

xfrm_device.c

net: use skb_sec_path helper in more places