netdev - [PATCH net] xfrm: calculate L4 checksums also for GSO case before encrypting packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Apr 2017 11:42:07 -0700
From:   Ansis Atteka <aatteka@....org>
To:     netdev@...r.kernel.org
Cc:     Ansis Atteka <aatteka@....org>
Subject: [PATCH net] xfrm: calculate L4 checksums also for GSO case before encrypting packets

Otherwise, if L4 checksum calculation is done after encryption,
then all ESP packets end up being corrupted at the location
where pre-encryption L4 checksum field resides.

One of the ways to reproduce this bug is to have a VM with virtio_net
driver (UFO set to ON in the guest VM); and then encapsulate all guest's
Ethernet frames in GENEVE; and then further encrypt GENEVE with IPsec.
In this case following symptoms are observed:
1. If using ixgbe NIC, then the driver will also emit following
   warning message:
   ixgbe 0000:01:00.1: partial checksum but l4 proto=32!
2. Receiving VM will drop all the corrupted ESP packets, hence UDP iperf test
   with large packets will fail completely or TCP iperf will get ridiculously
   low performance because TCP window will never grow above MTU.

Signed-off-by: Ansis Atteka <aatteka@....org>
---
 net/xfrm/xfrm_output.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 8ba29fe..7ad7e5f 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -168,7 +168,8 @@ static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb)

 static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-	struct sk_buff *segs;
+	struct sk_buff *segs, *nskb;
+	int err;

 	BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET);
 	BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET);
@@ -180,21 +181,27 @@ static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb
 		return -EINVAL;

 	do {
-		struct sk_buff *nskb = segs->next;
-		int err;
+		nskb = segs->next;

 		segs->next = NULL;
-		err = xfrm_output2(net, sk, segs);
+		err = skb_checksum_help(segs);
+		if (unlikely(err)) {
+			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
+			goto error;
+		}

+		err = xfrm_output2(net, sk, segs);
 		if (unlikely(err)) {
-			kfree_skb_list(nskb);
-			return err;
+			goto error;
 		}

 		segs = nskb;
 	} while (segs);

 	return 0;
+error:
+	kfree_skb_list(nskb);
+	return err;
 }

 int xfrm_output(struct sock *sk, struct sk_buff *skb)
-- 
1.9.1