Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-04 12:16:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
15f5fe9e84
linux-stable/net/xfrm
History
Antony Antony 15f5fe9e84 xfrm: Log input direction mismatch error in one place 
Previously, the offload data path decrypted the packet before checking
the direction, leading to error logging and packet dropping. However,
dropped packets wouldn't be visible in tcpdump or audit log.

With this fix, the offload path, upon noticing SA direction mismatch,
will pass the packet to the stack without decrypting it. The L3 layer
will then log the error, audit, and drop ESP without decrypting or
decapsulating it.

This also ensures that the slow path records the error and audit log,
making dropped packets visible in tcpdump.

Fixes: 304b44f0d5 ("xfrm: Add dir validation to "in" data path lookup")
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2024-06-17 13:53:19 +02:00
..
espintcp.c net: move netdev_max_backlog to net_hotdata 2024-03-07 21:12:42 -08:00
Kconfig ipsec: Select CRYPTO_AEAD 2023-10-01 16:28:14 +08:00
Makefile bpf: xfrm: Add bpf_xdp_get_xfrm_state() kfunc 2023-12-14 17:12:49 -08:00
xfrm_algo.c net: fill in MODULE_DESCRIPTION()s for xfrm 2024-02-09 14:12:01 -08:00
xfrm_compat.c xfrm: Add Direction to the SA in or out 2024-05-01 10:05:11 +02:00
xfrm_device.c xfrm: Add Direction to the SA in or out 2024-05-01 10:05:11 +02:00
xfrm_hash.c mm: remove include/linux/bootmem.h 2018-10-31 08:54:16 -07:00
xfrm_hash.h xfrm: add state hashtable keyed by seq 2021-05-14 13:52:01 +02:00
xfrm_inout.h xfrm: move xfrm4_extract_header to common helper 2020-05-06 09:40:08 +02:00
xfrm_input.c xfrm: Log input direction mismatch error in one place 2024-06-17 13:53:19 +02:00
xfrm_interface_bpf.c bpf: treewide: Annotate BPF kfuncs in BTF 2024-01-31 20:40:56 -08:00
xfrm_interface_core.c rtnetlink: allow rtnl_fill_link_netnsid() to run under RCU protection 2024-05-07 11:14:50 +02:00
xfrm_ipcomp.c net: introduce and use skb_frag_fill_page_desc() 2023-05-13 19:47:56 +01:00
xfrm_output.c xfrm: set skb control buffer based on packet offload as well 2024-03-05 10:49:44 +01:00
xfrm_policy.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-05-09 10:01:01 -07:00
xfrm_proc.c xfrm: Add dir validation to "in" data path lookup 2024-05-01 10:06:27 +02:00
xfrm_replay.c xfrm: Add Direction to the SA in or out 2024-05-01 10:05:11 +02:00
xfrm_state_bpf.c bpf: treewide: Annotate BPF kfuncs in BTF 2024-01-31 20:40:56 -08:00
xfrm_state.c xfrm: Add Direction to the SA in or out 2024-05-01 10:05:11 +02:00
xfrm_sysctl.c net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
xfrm_user.c xfrm: Restrict SA direction attribute to specific netlink message types 2024-05-01 10:06:59 +02:00