Paul Chaignon 0b91fda3a1 xfrm: Sanitize marks before insert ... Prior to this patch, the mark is sanitized (applying the state's mask to the state's value) only on inserts when checking if a conflicting XFRM state or policy exists. We discovered in Cilium that this same sanitization does not occur in the hot-path __xfrm_state_lookup. In the hot-path, the sk_buff's mark is simply compared to the state's value: if ((mark & x->mark.m) != x->mark.v) continue; Therefore, users can define unsanitized marks (ex. 0xf42/0xf00) which will never match any packet. This commit updates __xfrm_state_insert and xfrm_policy_insert to store the sanitized marks, thus removing this footgun. This has the side effect of changing the ip output, as the returned mark will have the mask applied to it when printed. Fixes: 3d6acfa764 ("xfrm: SA lookups with mark") Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Louis DeLosSantos <louis.delos.devel@gmail.com> Co-developed-by: Louis DeLosSantos <louis.delos.devel@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2025-05-14 07:18:58 +02:00
..
espintcp.c	espintcp: fix skb leaks	2025-04-14 11:58:50 +02:00
Kconfig
Makefile
trace_iptfs.h
xfrm_algo.c	xfrm: ipcomp: Use crypto_acomp interface	2025-03-21 17:36:49 +08:00
xfrm_compat.c
xfrm_device.c	xfrm: check for PMTU in tunnel mode for packet offload	2025-02-21 08:08:15 +01:00
xfrm_hash.c
xfrm_hash.h
xfrm_inout.h
xfrm_input.c
xfrm_interface_bpf.c
xfrm_interface_core.c	net: xfrm: Use link netns in newlink() of rtnl_link_ops	2025-02-21 15:28:03 -08:00
xfrm_ipcomp.c	xfrm: ipcomp: fix truesize computation on receive	2025-04-30 08:08:16 +02:00
xfrm_iptfs.c
xfrm_nat_keepalive.c
xfrm_output.c	ipsec-next-2025-03-24	2025-03-25 08:50:10 -07:00
xfrm_policy.c	xfrm: Sanitize marks before insert	2025-05-14 07:18:58 +02:00
xfrm_proc.c
xfrm_replay.c
xfrm_state_bpf.c
xfrm_state.c	xfrm: Sanitize marks before insert	2025-05-14 07:18:58 +02:00
xfrm_sysctl.c
xfrm_user.c