netdev - Re: [XFRM]: xfrm_user: fix selector family initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 14 Apr 2008 09:33:21 +0200
From:	"Marco Berizzi" <pupilla@...mail.com>
To:	"Patrick McHardy" <kaber@...sh.net>
Cc:	"Linux Netdev List" <netdev@...r.kernel.org>,
	"Kazunori MIYAZAWA" <kazunori@...azawa.org>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [XFRM]: xfrm_user: fix selector family initialization

Patrick McHardy wrote:

> Patrick McHardy wrote:
> > Patrick McHardy wrote:
> >> The problem appears to be that openswan doesn't initialize the
> >> selectors family when adding new SAs. xfrm_init_state() uses
> >> the family to decide whether to set up inter family SAs or
> >> regular SAs. We used to fix up the family in xfrm_user, but
> >> this is now only done for transport mode SAs.
> >>
> >> -       /*
> >> -        * Set inner address family if the KM left it as zero.
> >> -        * See comment in validate_tmpl.
> >> -        */
> >> -       if (!x->sel.family)
> >> +       if (x->props.mode == XFRM_MODE_TRANSPORT)
> >>                 x->sel.family = p->family;
> >> +
> >>
> >> Reverting this part should fix it, but would break inter family
> >> tunnels again. It seems we need a different indication for
> >> xfrm_init_state() for inter family SAs.
> >>
> >> Kazunori, any ideas?
> >
> >
> > Did you have a chance to look into this? This is most likely
> > going to break a lot of setups, so a fix is really needed
> > before 2.6.25 is released.
>
> <sigh>
>
> Marco, could you test this patch please?

[sorry for the huge delay]

Openswan is happy with this patch. I have tested
openswan 2.4.12 with linux 2.6.25-rc9
Thanks for fixing this issue before 2.6.25 final.


------------------------------------------------------------------------
--------


> commit 712e842d9d39b21da439c043242d8863a8eca7a3
> Author: Patrick McHardy <kaber@...sh.net>
> Date:   Wed Apr 9 15:25:45 2008 +0200
>
>     [XFRM]: xfrm_user: fix selector family initialization
>
>     Commit df9dcb45 ([IPSEC]: Fix inter address family IPsec tunnel
handling)
>     broke openswan by removing the selector initialization for tunnel
mode
>     in case it is uninitialized.
>
>     This patch restores the initialization, fixing openswan, but
probably
>     breaking inter-family tunnels again (unknown since the patch
author
>     disappeared). The correct thing for inter-family tunnels is
probably
>     to simply initialize the selector family explicitly.
>
>     Signed-off-by: Patrick McHardy <kaber@...sh.net>
>
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index 5d96f27..019d21d 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -288,7 +288,7 @@ static void copy_from_user_state(struct xfrm_state
*x, struct xfrm_usersa_info *
>   memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
>   x->props.flags = p->flags;
>
> - if (x->props.mode == XFRM_MODE_TRANSPORT)
> + if (!x->sel.family)
>   x->sel.family = p->family;
>
>  }
>


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html