Commit 811b3f9b authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'ipsec-2024-03-06' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 

Steffen Klassert says:

====================
pull request (net): ipsec 2024-03-06

1) Clear the ECN bits flowi4_tos in decode_session4().
   This was already fixed but the bug was reintroduced
   when decode_session4() switched to us the flow dissector.
   From Guillaume Nault.

2) Fix UDP encapsulation in the TX path with packet offload mode.
   From Leon Romanovsky,

3) Avoid clang fortify warning in copy_to_user_tmpl().
   From Nathan Chancellor.

4) Fix inter address family tunnel in packet offload mode.
   From Mike Yu.

* tag 'ipsec-2024-03-06' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  xfrm: set skb control buffer based on packet offload as well
  xfrm: fix xfrm child route lookup for packet offload
  xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
  xfrm: Pass UDP encapsulation in TX packet offload
  xfrm: Clear low order bits of ->flowi4_tos in decode_session4().
====================

Link: https://lore.kernel.org/r/20240306100438.3953516-1-steffen.klassert@secunet.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents d3eee81f 2ce0eae6

net/xfrm/xfrm_device.c

+1 −1
Original line number Diff line number Diff line
@@ -407,7 +407,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 
	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;

	struct net_device *dev = x->xso.dev;



	if (!x->type_offload || x->encap)

	if (!x->type_offload)

		return false;



	if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET ||

net/xfrm/xfrm_output.c

+5 −1
Original line number Diff line number Diff line
@@ -704,9 +704,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) 
{

	struct net *net = dev_net(skb_dst(skb)->dev);

	struct xfrm_state *x = skb_dst(skb)->xfrm;

	int family;

	int err;



	switch (x->outer_mode.family) {

	family = (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) ? x->outer_mode.family

		: skb_dst(skb)->ops->family;



	switch (family) {

	case AF_INET:

		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));

		IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;

net/xfrm/xfrm_policy.c

+4 −2
Original line number Diff line number Diff line
@@ -2694,7 +2694,9 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, 
			if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)

				mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);



			if (xfrm[i]->xso.type != XFRM_DEV_OFFLOAD_PACKET)

				family = xfrm[i]->props.family;



			oif = fl->flowi_oif ? : fl->flowi_l3mdev;

			dst = xfrm_dst_lookup(xfrm[i], tos, oif,

					      &saddr, &daddr, family, mark);
@@ -3416,7 +3418,7 @@ decode_session4(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve 
	}



	fl4->flowi4_proto = flkeys->basic.ip_proto;

	fl4->flowi4_tos = flkeys->ip.tos;

	fl4->flowi4_tos = flkeys->ip.tos & ~INET_ECN_MASK;

}



#if IS_ENABLED(CONFIG_IPV6)

net/xfrm/xfrm_user.c

+3 −0
Original line number Diff line number Diff line
@@ -2017,6 +2017,9 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 
	if (xp->xfrm_nr == 0)

		return 0;



	if (xp->xfrm_nr > XFRM_MAX_DEPTH)

		return -ENOBUFS;



	for (i = 0; i < xp->xfrm_nr; i++) {

		struct xfrm_user_tmpl *up = &vec[i];

		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];