lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 5 Dec 2014 11:43:31 +0100
From:	Steffen Klassert <steffen.klassert@...unet.com>
To:	Smart Weblications GmbH - Florian Wiessner 
	<f.wiessner@...rt-weblications.de>
CC:	<netdev@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
	<stable@...r.kernel.org>
Subject: Re: 3.12.33 - BUG xfrm_selector_match+0x25/0x2f6

On Thu, Dec 04, 2014 at 05:36:27PM +0100, Smart Weblications GmbH - Florian Wiessner wrote:
> Hi,
> 
> Am 04.12.2014 08:56, schrieb Steffen Klassert:
> > 
> > I really wonder why the xfrm_sk_policy_lookup codepath is taken here.
> > It looks like this is the processing of an inbound ipv4 packet that
> > is going to be rerouted to the output path by ipvs, so this packet
> > should not have socket context at all.
> > 
> > xfrm_sk_policy_lookup is called just if the packet has socket context
> > and the socket has an IPsec output policy configured. Do you use IPsec
> > socket policies?
> > 
> 
> Yes it is insane i do not know why this happens and i wonder as well - i do not
> have IPsec configured. I tried yesterday with only
> 
> CONFIG_XFRM=y
> CONFIG_XFRM_ALGO=m
> 
> and all other XFRM modules disabled, same problem.
> 
> I now compiled kernel without xfrm to check if the problem is somewhere else.
> 
> I have seen that on this box (debian squeeze) the racoon tool inserts xfrm
> polcies like so:
> 
> ip xfrm policy show
> src ::/0 dst ::/0
>         dir 4 priority 0 ptype main
> src ::/0 dst ::/0
>         dir 3 priority 0 ptype main
> src ::/0 dst ::/0
>         dir 4 priority 0 ptype main
> src ::/0 dst ::/0
>         dir 3 priority 0 ptype main
> src ::/0 dst ::/0
> ...

Well, these are socket policies. The ike deamon uses them
for SA negotiation.

> 
> I tried without racoon running and with ipsec userspace tools disabled, but the
> problem still exists without ipsec userspace tools.

Does this mean that it still happens if you have no IPsec policies
in the system?

> 
> Interesting is maybe, that the longer the node is running and interfaces are
> added to a bridge, the more policies sum up. Here is an overview of other nodes,
> but without ipvs running:

Would be interesting to see them.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists