• Tobias Brunner's avatar
    xfrm: Fix inbound traffic via XFRM interfaces across network namespaces · 660899dd
    Tobias Brunner authored
    After moving an XFRM interface to another namespace it stays associated
    with the original namespace (net in `struct xfrm_if` and the list keyed
    with `xfrmi_net_id`), allowing processes in the new namespace to use
    SAs/policies that were created in the original namespace.  For instance,
    this allows a keying daemon in one namespace to establish IPsec SAs for
    other namespaces without processes there having access to the keys or IKE
    credentials.
    
    This worked fine for outbound traffic, however, for inbound traffic the
    lookup for the interfaces and the policies used the incorrect namespace
    (the one the XFRM interface was moved to).
    
    Fixes: f203b76d ("xfrm: Add virtual xfrm interfaces")
    Signed-off-by: default avatarTobias Brunner <tobias@strongswan.org>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    660899dd
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
xfrm_algo.c Loading commit data...
xfrm_device.c Loading commit data...
xfrm_hash.c Loading commit data...
xfrm_hash.h Loading commit data...
xfrm_input.c Loading commit data...
xfrm_interface.c Loading commit data...
xfrm_ipcomp.c Loading commit data...
xfrm_output.c Loading commit data...
xfrm_policy.c Loading commit data...
xfrm_proc.c Loading commit data...
xfrm_replay.c Loading commit data...
xfrm_state.c Loading commit data...
xfrm_sysctl.c Loading commit data...
xfrm_user.c Loading commit data...