netdev - XFRM and IPv6 raw sockets and multicast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 4 Dec 2007 16:27:50 +0100
From:	"Hugo Santos" <hugosantos@...il.com>
To:	netdev@...r.kernel.org
Subject: XFRM and IPv6 raw sockets and multicast

Hi,

  I've ran into an issue which i'm not sure that is known. I'm able to
provide a patch if people feel this is something that should be fixed.

  Anyway, the source address of packets is not taken into account when
matching for xfrm policies when socket(AF_INET6, SOCK_RAW,
IPPROTO_RAW) sockets are used. This doesn't allow for (S,G) policies
to be deployed for IPv6 for local output packets as is required for
some multicast communications (read: SSM).

  The behavior is the same as in UDP, but ipv6_pinfo->saddr is not
usually set for these kind of sockets. I would say that if fl6_src is
any, it should be copied from the ipv6 header.

  Another question is why does raw.c require a msg_name? If
inet->hdrincl was set, it could use the ipv6 header destination
address in the absense of msg_name.

  Any comments? :-)

  Thanks,
    Hugo
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html