netdev - Re: [PATCH] udp: avoid ufo handling on IP payload compression packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 7 Mar 2017 08:53:24 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
CC:     Alexey Kodanev <alexey.kodanev@...cle.com>,
        <netdev@...r.kernel.org>, David Miller <davem@...emloft.net>
Subject: Re: [PATCH] udp: avoid ufo handling on IP payload compression packets

On Tue, Mar 07, 2017 at 03:01:50PM +0800, Herbert Xu wrote:
> On Mon, Mar 06, 2017 at 07:16:57AM +0100, Steffen Klassert wrote:
> >
> > > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> > > index b67719f..18383ef 100644
> > > --- a/net/ipv4/ip_output.c
> > > +++ b/net/ipv4/ip_output.c
> > > @@ -960,7 +960,10 @@ static int __ip_append_data(struct sock *sk,
> > >  	cork->length += length;
> > >  	if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
> > >  	    (sk->sk_protocol == IPPROTO_UDP) &&
> > > -	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
> > > +	    (rt->dst.dev->features & NETIF_F_UFO) &&
> > > +#ifdef CONFIG_XFRM
> > > +	    !rt->dst.xfrm &&
> > > +#endif
> > 
> > Please fix IPcomp to use rt->dst.header_len instead off adding
> > this ifdef to the generic networking code.
> 
> It's not that simple though.  IPComp's header_len is set to zero
> because we opportunistically drop the IPComp header when the total
> compressed length exceeds the original packet length.  That is,
> we only ever do IPComp when it does not cause the packet to expand.

Yes, indeed. And it makes sense of course.

> 
> So it seems that we need another way of indicating the presence of
> XFRM.

Then we probably have to use the !rt->dst.xfrm check. But then
we should use dst_xfrm() accessor, this avoids the ifdef here.