netdev - xfrm by MARK: expected behavior of masking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 14 Oct 2010 15:15:41 +0200
From:	"Gerd v. Egidy" <lists@...dy.de>
To:	jamal <hadi@...erus.ca>
Cc:	netdev@...r.kernel.org
Subject: xfrm by MARK: expected behavior of masking

Hi,

while looking at the xfrm by MARK code I found a case where the masking of 
marks does not work as I would it expect to work.

Take for example a mark value of 5 and a mask of 0xfffffffe
->
src 192.168.5.0/24 dst 192.168.1.0/24 
        dir out priority 1760 ptype main 
        mark 5/0xfffffffe
        tmpl src 172.16.1.131 dst 172.16.1.130
                proto esp reqid 16384 mode tunnel

The code to check the marks always (e.g. in xfrm_policy.c, but several other 
places too) looks like this:

(fl->mark & pol->mark.m) != pol->mark.v

This means that a flow marked with 5 will actually never match. You have to 
use the first number in the mask (4 in this case) to make the policy work.

Is this expected behavior?

I'd expect that the kernel would either
a) still match those packets
or
b) refuse to configure such a policy

Kind regards,

Gerd

-- 
Address (better: trap) for people I really don't want to get mail from:
jonas@...tusamerica.com
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html