public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 6.1 01/24] Fix XFRM-I support for nested ESP tunnels
@ 2023-02-15 20:45 Sasha Levin
  2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 02/24] arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro Sasha Levin
                   ` (22 more replies)
  0 siblings, 23 replies; 26+ messages in thread
From: Sasha Levin @ 2023-02-15 20:45 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Benedict Wong, Steffen Klassert, Sasha Levin, davem, edumazet,
	kuba, pabeni, netdev

From: Benedict Wong <benedictwong@google.com>

[ Upstream commit b0355dbbf13c0052931dd14c38c789efed64d3de ]

This change adds support for nested IPsec tunnels by ensuring that
XFRM-I verifies existing policies before decapsulating a subsequent
policies. Addtionally, this clears the secpath entries after policies
are verified, ensuring that previous tunnels with no-longer-valid
do not pollute subsequent policy checks.

This is necessary especially for nested tunnels, as the IP addresses,
protocol and ports may all change, thus not matching the previous
policies. In order to ensure that packets match the relevant inbound
templates, the xfrm_policy_check should be done before handing off to
the inner XFRM protocol to decrypt and decapsulate.

Notably, raw ESP/AH packets did not perform policy checks inherently,
whereas all other encapsulated packets (UDP, TCP encapsulated) do policy
checks after calling xfrm_input handling in the respective encapsulation
layer.

Test: Verified with additional Android Kernel Unit tests
Signed-off-by: Benedict Wong <benedictwong@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++++++++++++++---
 net/xfrm/xfrm_policy.c    |  3 +++
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 5a67b120c4dbd..94a3609548b11 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -310,6 +310,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
 	skb->mark = 0;
 }
 
+static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi,
+		       int encap_type, unsigned short family)
+{
+	struct sec_path *sp;
+
+	sp = skb_sec_path(skb);
+	if (sp && (sp->len || sp->olen) &&
+	    !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+		goto discard;
+
+	XFRM_SPI_SKB_CB(skb)->family = family;
+	if (family == AF_INET) {
+		XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+	} else {
+		XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
+		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
+	}
+
+	return xfrm_input(skb, nexthdr, spi, encap_type);
+discard:
+	kfree_skb(skb);
+	return 0;
+}
+
+static int xfrmi4_rcv(struct sk_buff *skb)
+{
+	return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET);
+}
+
+static int xfrmi6_rcv(struct sk_buff *skb)
+{
+	return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
+			   0, 0, AF_INET6);
+}
+
+static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+{
+	return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET);
+}
+
+static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+{
+	return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6);
+}
+
 static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
 {
 	const struct xfrm_mode *inner_mode;
@@ -937,8 +983,8 @@ static struct pernet_operations xfrmi_net_ops = {
 };
 
 static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
-	.handler	=	xfrm6_rcv,
-	.input_handler	=	xfrm_input,
+	.handler	=	xfrmi6_rcv,
+	.input_handler	=	xfrmi6_input,
 	.cb_handler	=	xfrmi_rcv_cb,
 	.err_handler	=	xfrmi6_err,
 	.priority	=	10,
@@ -988,8 +1034,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {
 #endif
 
 static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
-	.handler	=	xfrm4_rcv,
-	.input_handler	=	xfrm_input,
+	.handler	=	xfrmi4_rcv,
+	.input_handler	=	xfrmi4_input,
 	.cb_handler	=	xfrmi_rcv_cb,
 	.err_handler	=	xfrmi4_err,
 	.priority	=	10,
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 52538d5360673..7f49dab3b6b59 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3670,6 +3670,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
 			goto reject;
 		}
 
+		if (if_id)
+			secpath_reset(skb);
+
 		xfrm_pols_put(pols, npols);
 		return 1;
 	}
-- 
2.39.0


^ permalink raw reply related	[flat|nested] 26+ messages in thread
end of thread, other threads:[~2023-02-15 21:04 UTC | newest]

Thread overview: 26+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-15 20:45 [PATCH AUTOSEL 6.1 01/24] Fix XFRM-I support for nested ESP tunnels Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 02/24] arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 03/24] arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 04/24] ARM: dts: rockchip: add power-domains property to dp node on rk3288 Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 05/24] arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1 Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 06/24] arm64: dts: rockchip: fix probe of analog sound card on rock-3a Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 07/24] HID: elecom: add support for TrackBall 056E:011C Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 08/24] HID: Ignore battery for Elan touchscreen on Asus TP420IA Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 09/24] ACPI: NFIT: fix a potential deadlock during NFIT teardown Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 10/24] pinctrl: amd: Fix debug output for debounce time Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 11/24] btrfs: send: limit number of clones and allocated memory size Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 12/24] arm64: dts: rockchip: align rk3399 DMC OPP table with bindings Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 13/24] ASoC: rt715-sdca: fix clock stop prepare timeout issue Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 14/24] IB/hfi1: Assign npages earlier Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 15/24] powerpc: Don't select ARCH_WANTS_NO_INSTR Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 16/24] ASoC: SOF: amd: Fix for handling spurious interrupts from DSP Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 17/24] ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 18/24] neigh: make sure used and confirmed times are valid Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 19/24] HID: core: Fix deadloop in hid_apply_multiplier Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 20/24] ASoC: codecs: es8326: Fix DTS properties reading Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 21/24] HID: Ignore battery for ELAN touchscreen 29DF on HP Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 22/24] selftests: ocelot: tc_flower_chains: make test_vlan_ingress_modify() more comprehensive Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 23/24] x86/cpu: Add Lunar Lake M Sasha Levin
2023-02-15 20:45 ` [PATCH AUTOSEL 6.1 24/24] drm/amd/display: disable S/G display on DCN 3.1.2/3 Sasha Levin
2023-02-15 20:55   ` Alex Deucher
2023-02-15 21:01     ` Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox