netdev - Re: [PATCH v2] xfrm: Fix inter family IPsec tunnel handling again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 5 Jul 2008 19:56:55 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Steffen Klassert <steffen.klassert@...unet.com>
Cc:	David Miller <davem@...emloft.net>, kaber@...sh.net,
	netdev@...r.kernel.org, klassert@...hematik.tu-chemnitz.de
Subject: Re: [PATCH v2] xfrm: Fix inter family IPsec tunnel handling again

On Sat, Jul 05, 2008 at 09:19:50AM +0200, Steffen Klassert wrote:
> Move the selector family initialization behind the check for AF_UNSPEC
> and call xfrm_ip2inner_mode() in any case. So the selector family is
> intitalized and we can choose for the right inner_mode.
> 
> Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>
> ---
>  net/xfrm/xfrm_input.c |   19 ++++---------------
>  net/xfrm/xfrm_state.c |    2 ++
>  net/xfrm/xfrm_user.c  |    4 ----
>  3 files changed, 6 insertions(+), 19 deletions(-)
> 
> diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
> index 7527940..d220ecf 100644
> --- a/net/xfrm/xfrm_input.c
> +++ b/net/xfrm/xfrm_input.c
> @@ -91,11 +91,9 @@ int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
>  	if (err)
>  		return err;
>  
> -	if (x->sel.family == AF_UNSPEC) {
> -		inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
> -		if (inner_mode == NULL)
> -			return -EAFNOSUPPORT;
> -	}
> +	inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
> +	if (inner_mode == NULL)
> +		return -EAFNOSUPPORT;

If sel.family is specified, inner_mode should already be set, no?
Overriding it would seem insecure.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html