linux-hardening - Re: [PATCH net-next 0/3] net: Add sockaddr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250723154647.GI1036606@horms.kernel.org>
Date: Wed, 23 Jul 2025 16:46:47 +0100
From: Simon Horman <horms@...nel.org>
To: Kees Cook <kees@...nel.org>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
	Jakub Kicinski <kuba@...nel.org>,
	"Jason A. Donenfeld" <Jason@...c4.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
	Xin Long <lucien.xin@...il.com>, linux-kernel@...r.kernel.org,
	wireguard@...ts.zx2c4.com, netdev@...r.kernel.org,
	linux-sctp@...r.kernel.org, linux-hardening@...r.kernel.org,
	Kuniyuki Iwashima <kuniyu@...zon.com>,
	Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net-next 0/3] net: Add sockaddr_inet unified address
 structure

+ Iwashima-san and Willem

  This series looks like something you should review

On Tue, Jul 22, 2025 at 10:18:30AM -0700, Kees Cook wrote:
> Hi!
> 
> Repeating patch 1, as it has the rationale:
> 
>     There are cases in networking (e.g. wireguard, sctp) where a union is
>     used to provide coverage for either IPv4 or IPv6 network addresses,
>     and they include an embedded "struct sockaddr" as well (for "sa_family"
>     and raw "sa_data" access). The current struct sockaddr contains a
>     flexible array, which means these unions should not be further embedded
>     in other structs because they do not technically have a fixed size (and
>     are generating warnings for the coming -Wflexible-array-not-at-end flag
>     addition). But the future changes to make struct sockaddr a fixed size
>     (i.e. with a 14 byte sa_data member) make the "sa_data" uses with an IPv6
>     address a potential place for the compiler to get upset about object size
>     mismatches. Therefore, we need a sockaddr that cleanly provides both an
>     sa_family member and an appropriately fixed-sized sa_data member that does
>     not bloat member usage via the potential alternative of sockaddr_storage
>     to cover both IPv4 and IPv6, to avoid unseemly churn in the affected code
>     bases.
> 
>     Introduce sockaddr_inet as a unified structure for holding both IPv4 and
>     IPv6 addresses (i.e. large enough to accommodate sockaddr_in6).
> 
>     The structure is defined in linux/in6.h since its max size is sized
>     based on sockaddr_in6 and provides a more specific alternative to the
>     generic sockaddr_storage for IPv4 with IPv6 address family handling.
> 
>     The "sa_family" member doesn't use the sa_family_t type to avoid needing
>     layer violating header inclusions.
> 
> Also includes the replacements for wireguard and sctp.
> 
> Thanks,
> 
> -Kees
> 
> Kees Cook (3):
>   ipv6: Add sockaddr_inet unified address structure
>   wireguard: peer: Replace sockaddr with sockaddr_inet
>   sctp: Replace sockaddr with sockaddr_inet in sctp_addr union
> 
>  drivers/net/wireguard/peer.h | 2 +-
>  include/linux/in6.h          | 7 +++++++
>  include/net/sctp/structs.h   | 2 +-
>  3 files changed, 9 insertions(+), 2 deletions(-)
> 
> -- 
> 2.34.1
>