netdev - Re: [PATCH] key: fix setkey(8) policy set breakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20081031.164051.20530760.davem@davemloft.net>
Date:	Fri, 31 Oct 2008 16:40:51 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	adobriyan@...il.com
Cc:	yoshfuji@...ux-ipv6.org, netdev@...r.kernel.org
Subject: Re: [PATCH] key: fix setkey(8) policy set breakage

From: Alexey Dobriyan <adobriyan@...il.com>
Date: Sat, 1 Nov 2008 01:13:13 +0300

> Steps to reproduce:
> 
> 	#/usr/sbin/setkey -f
> 	flush;
> 	spdflush;
> 
> 	add 192.168.0.42 192.168.0.1 ah 24500 -A hmac-md5 "1234567890123456";
> 	add 192.168.0.42 192.168.0.1 esp 24501 -E 3des-cbc "123456789012123456789012";
> 
> 	spdadd 192.168.0.42 192.168.0.1 any -P out ipsec
> 		esp/transport//require
> 		ah/transport//require;
> 
> setkey: invalid keymsg length
> 
> Policy dump will bail out with the same message after that.
> 
> -recv(4, "\2\16\0\0\32\0\3\0\0\0\0\0\37\r\0\0\3\0\5\0\377 \0\0\2\0\0\0\300\250\0*\0"..., 32768, 0) = 208
> +recv(4, "\2\16\0\0\36\0\3\0\0\0\0\0H\t\0\0\3\0\5\0\377 \0\0\2\0\0\0\300\250\0*\0"..., 32768, 0) = 208
> 
> Dunno how to explain this, but the following patch works. :^)
> 
> Signed-off-by: Alexey Dobriyan <adobriyan@...il.com>

Thanks for this fix Alexey, applied.

> --- a/net/key/af_key.c
> +++ b/net/key/af_key.c
> @@ -2075,7 +2075,6 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, in
>  			req_size += socklen * 2;
>  		} else {
>  			size -= 2*socklen;
> -			socklen = 0;
>  		}
>  		rq = (void*)skb_put(skb, req_size);
>  		pol->sadb_x_policy_len += req_size/8;

Curious, I wonder why Yoshifuji-san zeros out this value in the first
place.  The default initialization of socklen never gets actually used
because of it.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html