pull request (net): ipsec 2021-03-31

[Steffen Klassert <steffen.klassert@secunet.com>]

1) Fix ipv4 pmtu checks for xfrm anf vti interfaces.
   From Eyal Birger.

2) There are situations where the socket passed to
   xfrm_output_resume() is not the same as the one
   attached to the skb. Use the socket passed to
   xfrm_output_resume() to avoid lookup failures
   when xfrm is used with VRFs.
   From Evan Nimmo.

3) Make the xfrm_state_hash_generation sequence counter per
   network namespace because but its write serialization
   lock is also per network namespace. Write protection
   is insufficient otherwise.
   From Ahmed S. Darwish.

4) Fixup sctp featue flags when used with esp offload.
   From Xin Long.

5) xfrm BEET mode doesn't support fragments for inner packets.
   This is a limitation of the protocol, so no fix possible.
   Warn at least to notify the user about that situation.
   From Xin Long.

6) Fix NULL pointer dereference on policy lookup when
   namespaces are uses in combination with esp offload.

7) Fix incorrect transformation on esp offload when
   packets get segmented at layer 3.

8) Fix some user triggered usages of WARN_ONCE in
   the xfrm compat layer.
   From Dmitry Safonov.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 3a2eb515d1367c0f667b76089a6e727279c688b8:

  octeontx2-af: Fix an off by one in rvu_dbg_qsize_write() (2021-02-21 13:29:25 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git master

for you to fetch changes up to ef19e111337f6c3dca7019a8bad5fbc6fb18d635:

  xfrm/compat: Cleanup WARN()s that can be user-triggered (2021-03-30 07:29:09 +0200)

----------------------------------------------------------------
Ahmed S. Darwish (2):
      net: xfrm: Localize sequence counter per network namespace
      net: xfrm: Use sequence counter with associated spinlock

Dmitry Safonov (1):
      xfrm/compat: Cleanup WARN()s that can be user-triggered

Evan Nimmo (1):
      xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume

Eyal Birger (3):
      xfrm: interface: fix ipv4 pmtu check to honor ip header df
      vti: fix ipv4 pmtu check to honor ip header df
      vti6: fix ipv4 pmtu check to honor ip header df

Steffen Klassert (2):
      xfrm: Fix NULL pointer dereference on policy lookup
      xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets

Xin Long (2):
      esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
      xfrm: BEET mode doesn't support fragments for inner packets

 include/net/netns/xfrm.h  |  4 +++-
 include/net/xfrm.h        |  4 ++--
 net/ipv4/ah4.c            |  2 +-
 net/ipv4/esp4.c           |  2 +-
 net/ipv4/esp4_offload.c   | 17 ++++++++++++++---
 net/ipv4/ip_vti.c         |  6 ++++--
 net/ipv6/ah6.c            |  2 +-
 net/ipv6/esp6.c           |  2 +-
 net/ipv6/esp6_offload.c   | 17 ++++++++++++++---
 net/ipv6/ip6_vti.c        |  6 ++++--
 net/xfrm/xfrm_compat.c    | 12 +++++++++---
 net/xfrm/xfrm_device.c    |  2 --
 net/xfrm/xfrm_interface.c |  3 +++
 net/xfrm/xfrm_output.c    | 23 ++++++++++++++++++-----
 net/xfrm/xfrm_state.c     | 11 ++++++-----
 15 files changed, 81 insertions(+), 32 deletions(-)