As the default we assume the traffic to pass, if we have no matching IPsec policy. With this patch, we have a possibility to change this default from allow to block. It can be configured via netlink. Each direction (input/output/forward) can be configured separately. With the default to block configuered, we need allow policies for all packet flows we accept. We do not use default policy lookup for the loopback device. v1->v2 - fix compiling when XFRM is disabled - Reported-by: kernel test robot <lkp@intel.com>
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -213,6 +213,11 @@ enum { · 212 unmodified lines | |||
| 213 | XFRM_MSG_GETSPDINFO, | 213 | XFRM_MSG_GETSPDINFO, |
| 214 | #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO | 214 | #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO |
| 215 | 215 | ||
| 216 | XFRM_MSG_SETDEFAULT, | ||
| 217 | #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT | ||
| 218 | XFRM_MSG_GETDEFAULT, | ||
| 219 | #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT | ||
| 220 | |||
| 216 | XFRM_MSG_MAPPING, | 221 | XFRM_MSG_MAPPING, |
| 217 | #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING | 222 | #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING |
| 218 | __XFRM_MSG_MAX | 223 | __XFRM_MSG_MAX |
| @@ -508,6 +513,11 @@ struct xfrm_user_offload { · 289 unmodified lines | |||
| 508 | #define XFRM_OFFLOAD_IPV6 1 | 513 | #define XFRM_OFFLOAD_IPV6 1 |
| 509 | #define XFRM_OFFLOAD_INBOUND 2 | 514 | #define XFRM_OFFLOAD_INBOUND 2 |
| 510 | 515 | ||
| 516 | struct xfrm_userpolicy_default { | ||
| 517 | __u8 dirmask; | ||
| 518 | __u8 action; | ||
| 519 | }; | ||
| 520 | |||
| 511 | #ifndef __KERNEL__ | 521 | #ifndef __KERNEL__ |
| 512 | /* backwards compatibility for userspace */ | 522 | /* backwards compatibility for userspace */ |
| 513 | #define XFRMGRP_ACQUIRE 1 | 523 | #define XFRMGRP_ACQUIRE 1 |