lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 5 Aug 2008 00:20:46 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Joakim Koskela <joakim.koskela@...t.fi>
Cc:	netdev@...r.kernel.org, yoshfuji@...e.ad.jp
Subject: Re: [PATCH 2/2] Interfamily IPSec BEET

On Mon, Aug 04, 2008 at 04:19:42PM +0300, Joakim Koskela wrote:
> This fixes the ipv4-inner, ipv6-outer mode.  This one is a bit more
> complex as not only do we need to take into account the difference
> between ipv4/ipv6 headers when adjusting the sk_buff network header,
> we also need to reserve extra room for the new ipv6 header.  This
> extra room, here got by adding it to the props.header_len, is needed
> to accomodate the new & larger ipv6 header (the kernel is currently
> panicing because of this).
> 
> The BEET ipv4 pseudo-header construction was also missing from the
> ipv6 output.
> 
> Signed-off-by: Joakim Koskela <jookos@...il.com>

Thanks for tracking this down Joakim! I'm sorry for not spending
any time on this earlier.

> diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
> index c6bb4c6..f09fcb9 100644
> --- a/net/ipv6/esp6.c
> +++ b/net/ipv6/esp6.c
> @@ -521,6 +521,10 @@ static int esp6_init_state(struct xfrm_state *x)
>  			      crypto_aead_ivsize(aead);
>  	switch (x->props.mode) {
>  	case XFRM_MODE_BEET:
> +		x->props.header_len += IPV4_BEET_PHMAXLEN;
> +		if (x->sel.family == AF_INET)
> +			x->props.header_len += (sizeof(struct ipv6hdr) - sizeof(struct iphdr));

This is still going to break with the new any family (i.e., v4
or v6) SA.  So perhaps that should be x->sel.family != AF_INET6.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists