Netdev List
 help / color / mirror / Atom feed
* [PATCH 0/14] pull request (net): ipsec 2026-11-02
@ 2026-11-02 10:03 Steffen Klassert
  2026-11-02 10:03 ` [PATCH 01/14] xfrm: retry inexact policy lookup after node reinsertion Steffen Klassert
                   ` (13 more replies)
  0 siblings, 14 replies; 16+ messages in thread
From: Steffen Klassert @ 2026-11-02 10:03 UTC (permalink / raw)
  To: David Miller, Jakub Kicinski; +Cc: Herbert Xu, Steffen Klassert, netdev

1) xfrm: retry inexact policy lookup after node reinsertion
   Detect a concurrent change of the inexact policy tree while it is
   searched and retry the lookup, so an insertion can't make it return
   the wrong policy.

2) xfrm: interface: validate the IP header on xmit
   Validate the IP header in xfrmi_xmit() like the IP receive path
   does, so packets injected into an xfrm interface can't reach the
   output path with a malformed header.

3) xfrm: zero-initialise km_event in the replay-notify path
   Zero-initialise the replay event so the netlink header of a
   kernel-originated replay notification no longer carries
   uninitialised stack values.

4) xfrm: espintcp: reorder operations within espintcp_init_sk
   Publish the ESP-in-TCP context before installing the socket
   callbacks, so an early callback can't dereference a context that
   isn't set up yet.

5) xfrm: state: reject mark with bits outside its mask on add
   Reject a mark with bits outside its mask on state insert instead
   of silently truncating it, so a lookup can't be given a mark that
   never matches.

6) xfrm: state: reject mark with bits outside its mask on ALLOCSPI
   Apply the same mark validation to ALLOCSPI, keeping the state and
   policy insert paths consistent.

7) xfrm: policy: reject mark with bits outside its mask on add
   Apply the same mark validation to policy insert, so a policy can't
   be stored with a mark that never matches.

8) xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups
   Match mark and mask exactly in the SPI-keyed netlink SA lookups, so
   a catch-all SA can no longer shadow a more specific one.

9) xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
   Hold the cloned state for the whole migration, so a concurrent
   delete can't free it while it is still in use.

10) xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path
    Remove the hardware offload of the cloned state on the migration
    error path, so the offloaded SA entry isn't leaked.

11) xfrm: include mark in MIGRATE_STATE SA collision check
    Include the mark in the SA collision check, so a migration that
    only changes the mark can't install a duplicate SA tuple.

12) xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state()
    Pass the extack to xfrm_init_replay(), so replay window errors can
    be reported to userspace.

13) docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple
    Document the mark as part of the EEXIST tuple of the SA migration
    request.

14) xfrm4: use a full socket for local errors
    Resolve the socket owner with skb_to_full_sk() in the IPv4 local
    error path, so a TCP request socket isn't used as a full socket.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit c9151088f1674fd29ff26a20f5fc687acf53a2f0:

  Merge branch 'net-psp-avoid-conflicts-with-skb-decrypted-and-sk_validate_xmit_skb' (2026-09-16 19:18:26 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git tags/ipsec-2026-11-02

for you to fetch changes up to 5def91015ba7b59de62a81384572da7281b8a033:

  xfrm4: use a full socket for local errors (2026-10-27 09:09:36 +0000)

----------------------------------------------------------------
ipsec-2026-11-02

----------------------------------------------------------------
Antony Antony (9):
      xfrm: state: reject mark with bits outside its mask on add
      xfrm: state: reject mark with bits outside its mask on ALLOCSPI
      xfrm: policy: reject mark with bits outside its mask on add
      xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups
      xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
      xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path
      xfrm: include mark in MIGRATE_STATE SA collision check
      xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state()
      docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple

Chengfeng Ye (1):
      xfrm: retry inexact policy lookup after node reinsertion

Fourie Zhang (1):
      xfrm4: use a full socket for local errors

Qihang (1):
      xfrm: interface: validate the IP header on xmit

Sabrina Dubroca (1):
      xfrm: espintcp: reorder operations within espintcp_init_sk

Shubham Antil (1):
      xfrm: zero-initialise km_event in the replay-notify path

Steffen Klassert (1):
      Merge branch 'xfrm: state: exact mark/mask match for control-plane SA lookups'

 .../networking/xfrm/xfrm_migrate_state.rst         |  25 +++--
 include/net/espintcp.h                             |   5 +-
 include/net/xfrm.h                                 |   7 ++
 net/ipv4/xfrm4_output.c                            |   7 +-
 net/xfrm/espintcp.c                                |  43 +++++----
 net/xfrm/xfrm_interface_core.c                     |   8 ++
 net/xfrm/xfrm_policy.c                             |  14 ++-
 net/xfrm/xfrm_replay.c                             |   6 +-
 net/xfrm/xfrm_state.c                              | 101 +++++++++++++++++----
 net/xfrm/xfrm_user.c                               |  81 ++++++++++++-----
 10 files changed, 220 insertions(+), 77 deletions(-)

^ permalink raw reply	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2026-11-02  8:09 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-02 10:03 [PATCH 0/14] pull request (net): ipsec 2026-11-02 Steffen Klassert
2026-11-02 10:03 ` [PATCH 01/14] xfrm: retry inexact policy lookup after node reinsertion Steffen Klassert
2026-11-02  8:09   ` netdev-bot+sinfo
2026-11-02 10:04 ` [PATCH 02/14] xfrm: interface: validate the IP header on xmit Steffen Klassert
2026-11-02 10:04 ` [PATCH 03/14] xfrm: zero-initialise km_event in the replay-notify path Steffen Klassert
2026-11-02 10:04 ` [PATCH 04/14] xfrm: espintcp: reorder operations within espintcp_init_sk Steffen Klassert
2026-11-02 10:04 ` [PATCH 05/14] xfrm: state: reject mark with bits outside its mask on add Steffen Klassert
2026-11-02 10:04 ` [PATCH 06/14] xfrm: state: reject mark with bits outside its mask on ALLOCSPI Steffen Klassert
2026-11-02 10:04 ` [PATCH 07/14] xfrm: policy: reject mark with bits outside its mask on add Steffen Klassert
2026-11-02 10:04 ` [PATCH 08/14] xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups Steffen Klassert
2026-11-02 10:04 ` [PATCH 09/14] xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state() Steffen Klassert
2026-11-02 10:04 ` [PATCH 10/14] xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path Steffen Klassert
2026-11-02 10:04 ` [PATCH 11/14] xfrm: include mark in MIGRATE_STATE SA collision check Steffen Klassert
2026-11-02 10:04 ` [PATCH 12/14] xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state() Steffen Klassert
2026-11-02 10:04 ` [PATCH 13/14] docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple Steffen Klassert
2026-11-02 10:04 ` [PATCH 14/14] xfrm4: use a full socket for local errors Steffen Klassert

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox