netdev - Re: [PATCH net v3] vti: fix spd lookup: match plaintext pkt, not ipsec pkt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 3 Dec 2013 10:39:34 +0100
From:	Steffen Klassert <steffen.klassert@...unet.com>
To:	Christophe Gouault <christophe.gouault@...nd.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	netdev@...r.kernel.org, Saurabh Mohan <saurabh.mohan@...tta.com>,
	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>,
	Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: [PATCH net v3] vti: fix spd lookup: match plaintext pkt, not
 ipsec pkt

On Tue, Dec 03, 2013 at 10:01:07AM +0100, Christophe Gouault wrote:
> >
> >On transmit side:
> >
> >1. Mark the packet with the o_key. The policy and the state
> >    must match this key now.
> >
> >2. Do a xfrm_lookup on the original packet with the mark applied.
> >
> >3. Check if we got an IPsec route.
> >
> >4. Clean the skb to not leak informations on namespace
> >    transitions.
> >
> >5. Attach the dst_enty we got from the xfrm_lookup to the skb.
> 
> I am just wondering when exactly the netns transition IPsec and route
> lookups are performed (as far as I understand, we first need to perform
> the SP+SA lookup in inner netns, then change namespaces to outer
> netns, then perform a route lookup).
> 

The idea is to do the xfrm_lookup based on the original dst_entry that
comes with the skb. xfrm_lookup then generates a bundle with the IPsec
dst entries on top. Later xfrm_output pops all IPsec dst entires from
the skb, such that only the original routing one remains. I did not
do much with namespaces so far, but after the IPsec processing we should
be in the situation as we are when we transmitting via ipip. If it
works there it should work with vti too.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html