netdev - Re: [PATCH v2] vti: use right inner_mode for inbound inter address family policy checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 9 Sep 2016 10:36:42 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     <thomas.zeitlhofer+lkml@...it.at>
CC:     Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>, <netdev@...r.kernel.org>
Subject: Re: [PATCH v2] vti: use right inner_mode for inbound inter address
 family policy checks

On Wed, Sep 07, 2016 at 08:40:38PM +0200, thomas.zeitlhofer+lkml@...it.at wrote:
> In case of inter address family tunneling (IPv6 over vti4 or IPv4 over
> vti6), the inbound policy checks in vti_rcv_cb() and vti6_rcv_cb() are
> using the wrong address family. As a result, all inbound inter address
> family traffic is dropped.
> 
> Use the xfrm_ip2inner_mode() helper, as done in xfrm_input() (i.e., also
> increment LINUX_MIB_XFRMINSTATEMODEERROR in case of error), to select the
> inner_mode that contains the right address family for the inbound policy
> checks.
> 
> Signed-off-by: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@...it.at>
> ---
> 
> Notes:
>     v2: implement review comments from Steffen (thanks for the reply):
>     
>     	- return -EINVAL in case of error
>     
>     	- increment LINUX_MIB_XFRMINSTATEMODEERROR in case of error
>     
>     	  Just to point that out, in case there are arguments against it:
>     	  this is done in the namespace of skb->dev and not in the
>     	  t(unnel)?->net namespace.

This is ok because the states are configured in that namespace.

I've applied this to the ipsec tree, thanks a lot!