Commit 660899dd authored Feb 18, 2019 by Tobias Brunner Committed by Steffen Klassert Feb 18, 2019

xfrm: Fix inbound traffic via XFRM interfaces across network namespaces



After moving an XFRM interface to another namespace it stays associated
with the original namespace (net in `struct xfrm_if` and the list keyed
with `xfrmi_net_id`), allowing processes in the new namespace to use
SAs/policies that were created in the original namespace.  For instance,
this allows a keying daemon in one namespace to establish IPsec SAs for
other namespaces without processes there having access to the keys or IKE
credentials.

This worked fine for outbound traffic, however, for inbound traffic the
lookup for the interfaces and the policies used the incorrect namespace
(the one the XFRM interface was moved to).

Fixes: f203b76d ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent fc2d5cfd

net/xfrm/xfrm_interface.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -76,10 +76,10 @@ static struct xfrm_if xfrmi_decode_session(struct sk_buff skb)
	int ifindex;		int ifindex;
	struct xfrm_if *xi;		struct xfrm_if *xi;

	if (!skb->dev)		if (!secpath_exists(skb) \|\| !skb->dev)
	return NULL;		return NULL;

	xfrmn = net_generic(dev_net(skb->dev), xfrmi_net_id);		xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id);
	ifindex = skb->dev->ifindex;		ifindex = skb->dev->ifindex;

	for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {		for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {

net/xfrm/xfrm_policy.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -3314,8 +3314,10 @@ int __xfrm_policy_check(struct sock sk, int dir, struct sk_buff skb,

	if (ifcb) {		if (ifcb) {
	xi = ifcb->decode_session(skb);		xi = ifcb->decode_session(skb);
	if (xi)		if (xi) {
	if_id = xi->p.if_id;		if_id = xi->p.if_id;
			net = xi->net;
			}
	}		}
	rcu_read_unlock();		rcu_read_unlock();

Admin message