)]}'
{
  "commit": "835912998ca54a76b5c57f8c8459a86b1b45de40",
  "tree": "ddf6334b015d9e8304b3b2c1b5d68414c4b21401",
  "parents": [
    "f9a11716c8445b496e9fafeec7e8412d384d02e2",
    "dcf413245c8c2351f7f80502f89c344256f61a66"
  ],
  "author": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Tue Oct 20 07:41:14 2026 +0200"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Tue Oct 20 07:41:14 2026 +0200"
  },
  "message": "Merge branch \u0027xfrm: state: exact mark/mask match for control-plane SA lookups\u0027\n\nAntony Antony says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWhile looking into a XFRM_MSG_MIGRATE_STATE issue reported by Sashiko,\nwe found the underlying problem generalizes: xfrm allows multiple SAs\nto coexist for the same (SPI, daddr, proto) differing only in mark,\nand every netlink method that resolves \"which SA\" - xfrm get_sa(),\ndel_sa(), update, get_ae, new_ae, expire, migrate - uses the same\nwildcard mark match the data path needs. A broader-mask SA can\nsilently shadow a more specific one:\n\n  # ip xfrm state add ... spi 0x1000 mark 1 mask 1 (SA_target)\n  # ip xfrm state add ... spi 0x1000 mark 0 mask 0\n    (SA_decoy, catch-all, added after -\u003e bucket head)\n  # ip xfrm state delete dst ... proto esp spi 0x1000 mark 1 mask 1\n    -\u003e deletes SA_decoy; SA_target survives, untouched\n\nxfrm policy had the same bug, fixed in commit 4f47e8ab6ab7\n(\"xfrm: policy: match with both mark and mask on user interfaces\").\n\nNetlink state lookups using spi use an exact mark/mask match except\nfor UPDSA; the wildcard match stays for the data path and state_add only.\nThis series applies that fix across every affected method,\nnot just XFRM_MSG_MIGRATE_STATE.\n\nAlso reject marks with value bits outside the mask (state ADD,\nALLOCSPI, policy ADD, MIGRATE_STATE new mark). These are\nmisconfigurations anyway, since the extra bits can never match, and\nbreak exact match added here.\n\nThis series does not touch PF_KEY, which no longer receives\nnon-critical fixes.\n\nstate_lookup_byaddr is out of scope. This is only fixing spi based\nlookups.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": []
}