netdev - Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200705111622.24680.joakim.koskela@hiit.fi>
Date:	Fri, 11 May 2007 16:22:24 +0300
From:	Joakim Koskela <joakim.koskela@...t.fi>
To:	netdev@...r.kernel.org
Subject: Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

Hi all, 

I'm running a system where there might be multiple simultenously
active ipsec states between two hosts (ipv6, but guess it applies to
v4 as well) where the outer ip is the same for all states, but the
inner differ (using beet mode).

The problem is that after establishing these states, it seems that the
one associated with outgoing traffic is selected solely by the outer
address (the first state matching the outer ip-pairs is used), which
usually results in the wrong spi and the packet being dropped at the
receiver.

I've circumvented the problem by modifying the state selection
algorithm in xfrm_state_find() [xfrm_state.c] to prefer, if possible,
states which also match by the inner addresses. Is this really a
problem of the selection algorithm, or might I be doing something 
wrong elsewhere?

Here's the changes I've done to make it work for me.  As said, it
prefers states with matching inner-address, but if none is found it
works as before:

diff -urN  a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
--- a/net/xfrm/xfrm_state.c 2007-05-11 15:37:35.000000000 +0300
+++ b/net/xfrm/xfrm_state.c 2007-05-11 15:37:35.000000000 +0300
@@ -374,6 +374,17 @@
                                    (best->km.dying == x->km.dying &&
                                     best->curlft.add_time < x->curlft.add_time))
                                        best = x;
+                               else if (pol->selector.family == x->sel.family &&
+                                        (pol->selector.family == AF_INET6 &&
+                                         !ipv6_addr_cmp((struct in6_addr *)&pol->selector.daddr,
+                                                        (struct in6_addr *)&x->sel.daddr) &&
+                                         !ipv6_addr_cmp((struct in6_addr *)&pol->selector.saddr,
+                                                        (struct in6_addr *)&x->sel.saddr)) ||
+                                        (pol->selector.family == AF_INET &&
+                                         pol->selector.daddr.a4 == x->sel.daddr.a4 &&
+                                         pol->selector.saddr.a4 == x->sel.saddr.a4))
+                                       best = x;
+
                        } else if (x->km.state == XFRM_STATE_ACQ) {
                                acquire_in_progress = 1;
                        } else if (x->km.state == XFRM_STATE_ERROR ||

br, j

--
Joakim Koskela
Helsinki Institute for Information Technology, http://www.hiit.fi
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html