netdev - Re: [IPSEC] flow: Cache negative results

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0701100913050.8582@d.namei>
Date:	Wed, 10 Jan 2007 09:15:15 -0500 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Herbert Xu <herbert.xu@...hat.com>
cc:	Venkat Yekkirala <vyekkirala@...stedCS.com>,
	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
	Paul Moore <paul.moore@...com>
Subject: Re: [IPSEC] flow: Cache negative results

On Wed, 10 Jan 2007, Herbert Xu wrote:

> Hi:
> 
> [IPSEC] flow: Cache negative security checks

We did some work in this part of the code a few months back -- IIRC it was 
resolved correctly from a security point of view.

(cc'ing Venkat & Paul for review).

> 
> This patch causes security policy denials to be cached instead of
> causing a relookup every time.  This is OK because we already cache
> positive security policy results which is strictly worse as far as
> security is concerned.  In particular, if the security system (not
> IPsec policies but the rules under security/) changes such that a
> positive result turns negative (denial), we will ignore it and
> continue to allow traffic through based on the cached policy.
> 
> So if the security folks actually care about this, they'd need to
> flush the flow cache whenever a relevant change is made to the
> security database.  Whether this is done or not does not affect
> this patch.
> 
> Given that we do want to cache positive results even in the presence
> of SELinux (otherwise we might as well disable flow.c entirely), it
> is natural to cache negative results too.
> 
> This patch also happens to fix a nasty bug where if an expiring
> flow entry that's not at the head happens to trigger a security
> denial, all entries before it are removed from the cache and
> leaked.
> 
> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
> 
> Cheers,
> 

-- 
James Morris
<jmorris@...ei.org>
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html