netdev - Re: [PATCH 2/2] Interfamily IPSec BEET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080804162046.GA12969@gondor.apana.org.au>
Date:	Tue, 5 Aug 2008 00:20:46 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Joakim Koskela <joakim.koskela@...t.fi>
Cc:	netdev@...r.kernel.org, yoshfuji@...e.ad.jp
Subject: Re: [PATCH 2/2] Interfamily IPSec BEET

On Mon, Aug 04, 2008 at 04:19:42PM +0300, Joakim Koskela wrote:
> This fixes the ipv4-inner, ipv6-outer mode.  This one is a bit more
> complex as not only do we need to take into account the difference
> between ipv4/ipv6 headers when adjusting the sk_buff network header,
> we also need to reserve extra room for the new ipv6 header.  This
> extra room, here got by adding it to the props.header_len, is needed
> to accomodate the new & larger ipv6 header (the kernel is currently
> panicing because of this).
> 
> The BEET ipv4 pseudo-header construction was also missing from the
> ipv6 output.
> 
> Signed-off-by: Joakim Koskela <jookos@...il.com>

Thanks for tracking this down Joakim! I'm sorry for not spending
any time on this earlier.

> diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
> index c6bb4c6..f09fcb9 100644
> --- a/net/ipv6/esp6.c
> +++ b/net/ipv6/esp6.c
> @@ -521,6 +521,10 @@ static int esp6_init_state(struct xfrm_state *x)
>  			      crypto_aead_ivsize(aead);
>  	switch (x->props.mode) {
>  	case XFRM_MODE_BEET:
> +		x->props.header_len += IPV4_BEET_PHMAXLEN;
> +		if (x->sel.family == AF_INET)
> +			x->props.header_len += (sizeof(struct ipv6hdr) - sizeof(struct iphdr));

This is still going to break with the new any family (i.e., v4
or v6) SA.  So perhaps that should be x->sel.family != AF_INET6.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html