]> git.itanic.dy.fi Git - linux-stable/commit
xfrm: policy: replace session decode with flow dissector
authorFlorian Westphal <fw@strlen.de>
Wed, 4 Oct 2023 16:09:53 +0000 (18:09 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Fri, 6 Oct 2023 06:35:12 +0000 (08:35 +0200)
commit7a0207094f1b14b2a690594e9b3587dddff0be5d
tree8afd6d450629685f986249d286b5556efc9b9d2b
parent45f87dd6b309b29541224e8212591abb6d294406
xfrm: policy: replace session decode with flow dissector

xfrm needs to populate ipv4/v6 flow struct for route lookup.
In the past there were several bugs in this code:

1. callers that forget to reload header pointers after
   xfrm_decode_session() (it may pull headers).
2. bugs in decoding where accesses past skb->data occurred.

Meanwhile network core gained a packet dissector as well.
This switches xfrm to the flow dissector.

Changes since RFC:
Drop ipv6 mobiliy header support, AFAIU noone uses this.

Drop extraction of flowlabel, replaced code doesn't set it either.

Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/netdev/20230908120628.26164-3-fw@strlen.de/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/xfrm/xfrm_policy.c