Commit e0f9f0e0 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'ipsec-next-2023-10-28' of... 

Merge tag 'ipsec-next-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says:

====================
pull request (net-next): ipsec-next 2023-10-28

1) Remove unused function declarations of xfrm4_extract_input and
   xfrm6_extract_input. From Yue Haibing.

2) Annotate struct xfrm_sec_ctx with __counted_by.
   From Kees Cook.

3) Support GRO decapsulation for ESP in UDP encapsulation.
   From Antony Antony et all.

4) Replace the xfrm session decode with flow dissector.
   From Florian Westphal.

5) Fix a use after free in __xfrm6_udp_encap_rcv.

6) Fix the layer 4 flowi decoding.
   From Florian Westphal.

* tag 'ipsec-next-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next:
  xfrm: policy: fix layer 4 flowi decoding
  xfrm Fix use after free in __xfrm6_udp_encap_rcv.
  xfrm: policy: replace session decode with flow dissector
  xfrm: move mark and oif flowi decode into common code
  xfrm: pass struct net to xfrm_decode_session wrappers
  xfrm: Support GRO for IPv6 ESP in UDP encapsulation
  xfrm: Support GRO for IPv4 ESP in UDP encapsulation
  xfrm: Use the XFRM_GRO to indicate a GRO call on input
  xfrm: Annotate struct xfrm_sec_ctx with __counted_by
  xfrm: Remove unused function declarations
====================

Link: https://lore.kernel.org/r/20231028084328.3119236-1-steffen.klassert@secunet.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 55c90047 eefed766

include/net/gro.h

+1 −1
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ struct napi_gro_cb { 
	/* Number of segments aggregated. */

	u16	count;



	/* Used in ipv6_gro_receive() and foo-over-udp */

	/* Used in ipv6_gro_receive() and foo-over-udp and esp-in-udp */

	u16	proto;



/* Used in napi_gro_cb::free */

include/net/ipv6_stubs.h

+3 −0
Original line number Diff line number Diff line
@@ -60,6 +60,9 @@ struct ipv6_stub { 
#if IS_ENABLED(CONFIG_XFRM)

	void (*xfrm6_local_rxpmtu)(struct sk_buff *skb, u32 mtu);

	int (*xfrm6_udp_encap_rcv)(struct sock *sk, struct sk_buff *skb);

	struct sk_buff *(*xfrm6_gro_udp_encap_rcv)(struct sock *sk,

						   struct list_head *head,

						   struct sk_buff *skb);

	int (*xfrm6_rcv_encap)(struct sk_buff *skb, int nexthdr, __be32 spi,

			       int encap_type);

#endif

include/net/xfrm.h

+10 −8
Original line number Diff line number Diff line
@@ -1207,20 +1207,20 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 
	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);

}



int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,

int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,

			  unsigned int family, int reverse);



static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,

static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,

				      unsigned int family)

{

	return __xfrm_decode_session(skb, fl, family, 0);

	return __xfrm_decode_session(net, skb, fl, family, 0);

}



static inline int xfrm_decode_session_reverse(struct sk_buff *skb,

static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,

					      struct flowi *fl,

					      unsigned int family)

{

	return __xfrm_decode_session(skb, fl, family, 1);

	return __xfrm_decode_session(net, skb, fl, family, 1);

}



int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
@@ -1296,7 +1296,7 @@ static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *sk 
{

	return 1;

}

static inline int xfrm_decode_session_reverse(struct sk_buff *skb,

static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,

					      struct flowi *fl,

					      unsigned int family)

{
@@ -1669,7 +1669,6 @@ int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb); 
#endif



void xfrm_local_error(struct sk_buff *skb, int mtu);

int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);

int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,

		    int encap_type);

int xfrm4_transport_finish(struct sk_buff *skb, int async);
@@ -1689,7 +1688,6 @@ int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char prot 
int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);

int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);

void xfrm4_local_error(struct sk_buff *skb, u32 mtu);

int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);

int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,

		  struct ip6_tnl *t);

int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
@@ -1712,6 +1710,10 @@ int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 
void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);

int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);

int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);

struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,

					struct sk_buff *skb);

struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,

					struct sk_buff *skb);

int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,

		     int optlen);

#else

include/uapi/linux/xfrm.h

+2 −1
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ 


#include <linux/in6.h>

#include <linux/types.h>

#include <linux/stddef.h>



/* All of the structures in this file may not change size as they are

 * passed into the kernel from userspace via netlink sockets.
@@ -33,7 +34,7 @@ struct xfrm_sec_ctx { 
	__u8	ctx_alg;

	__u16	ctx_len;

	__u32	ctx_sid;

	char	ctx_str[];

	char	ctx_str[] __counted_by(ctx_len);

};



/* Security Context Domains of Interpretation */

net/ipv4/esp4_offload.c

+5 −1
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 
	int offset = skb_gro_offset(skb);

	struct xfrm_offload *xo;

	struct xfrm_state *x;

	int encap_type = 0;

	__be32 seq;

	__be32 spi;
@@ -70,6 +71,9 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 


	xo->flags |= XFRM_GRO;



	if (NAPI_GRO_CB(skb)->proto == IPPROTO_UDP)

		encap_type = UDP_ENCAP_ESPINUDP;



	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;

	XFRM_SPI_SKB_CB(skb)->family = AF_INET;

	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
@@ -77,7 +81,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 


	/* We don't need to handle errors from xfrm_input, it does all

	 * the error handling and frees the resources on error. */

	xfrm_input(skb, IPPROTO_ESP, spi, -2);

	xfrm_input(skb, IPPROTO_ESP, spi, encap_type);



	return ERR_PTR(-EINPROGRESS);

out_reset: