diff options
| author | Martin Willi <martin@strongswan.org> | 2019-03-26 13:20:43 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-05-25 18:23:41 +0200 |
| commit | 6faa620606247d641201cf80c4521d252dc342c6 (patch) | |
| tree | 1d484b96a6f9a7f0009e2c153c4410cb499293a6 /include | |
| parent | 3716c26250997e5c78146c873094360a6d644df5 (diff) | |
xfrm: Honor original L3 slave device in xfrmi policy lookup
[ Upstream commit 025c65e119bf58b610549ca359c9ecc5dee6a8d2 ]
If an xfrmi is associated to a vrf layer 3 master device,
xfrm_policy_check() fails after traffic decapsulation. The input
interface is replaced by the layer 3 master device, and hence
xfrmi_decode_session() can't match the xfrmi anymore to satisfy
policy checking.
Extend ingress xfrmi lookup to honor the original layer 3 slave
device, allowing xfrm interfaces to operate within a vrf domain.
Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/xfrm.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 3e966c632f3b..4ddd2b13ac8d 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -295,7 +295,8 @@ struct xfrm_replay { }; struct xfrm_if_cb { - struct xfrm_if *(*decode_session)(struct sk_buff *skb); + struct xfrm_if *(*decode_session)(struct sk_buff *skb, + unsigned short family); }; void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb); |