]> git.ipfire.org Git - thirdparty/linux.git/commit
xfrm: allow migration from UDP encapsulated to non-encapsulated ESP
authorAntony Antony <antony.antony@secunet.com>
Tue, 26 May 2026 19:06:33 +0000 (21:06 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Thu, 4 Jun 2026 10:22:36 +0000 (12:22 +0200)
commitb8addb8884f2dc1b13cf3e4fa0265ecd0bc58b69
tree8b97931913f236278e6bb3af68ab0c2d22d3790b
parent231a1744dc433e8f39871a8fd0f5eab78202e136
xfrm: allow migration from UDP encapsulated to non-encapsulated ESP

The current code prevents migrating an SA from UDP encapsulation to
plain ESP. This is needed when moving from a NATed path to a non-NATed
one, for example when switching from IPv4+NAT to IPv6.

Only copy the existing encapsulation during migration if the encap
attribute is explicitly provided.

Note: PF_KEY's SADB_X_MIGRATE always passes encap=NULL and never
supported encapsulation in migration. PF_KEY is deprecated and was
in feature freeze when UDP encapsulation was added to xfrm.

Tested-by: Yan Yan <evitayan@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/xfrm/xfrm_state.c