netdev - Re: [RFC] ip tunnel flag byte order issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 10 Oct 2012 21:26:36 +0100
From:	Ben Hutchings <bhutchings@...arflare.com>
To:	Stephen Hemminger <shemminger@...tta.com>
CC:	David Miller <davem@...emloft.net>,
	Saurabh Mohan <saurabh.mohan@...tta.com>,
	<netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [RFC] ip tunnel flag byte order issue

On Wed, 2012-10-10 at 12:06 -0700, Stephen Hemminger wrote:
> Sparse found a real problem with the ABI for tunnelling.
> 
> The SIT and VTI tunnel ioctl's both overload the i_flags field in the
> ip_tunnel parameters structure. This field is defined as big endian
> (be16) and the various GRE_XXX macros do the necessary byte swapping.
> 
> The problem is that both SIT and VTI are using an additional flag bit
> that is defined in host byte order, and is then or'd in. It happens to
> work because both possible locations hit holes in the current usage of
> GRE.  For big endian cpu's it overlaps the GRE_VERSION which is always
> zero, and for little endian it overlaps the GRE recursion field also
> always zero.

Why do these fields exist if they're always going to be 0?

> Having the field in different places on different CPU architectures
> was a mistake. The problem is fixing it will break the ABI on one or
> the other architecture.  I choose to break big endian since it the
> minority.

Or we can define the 'flag' to have both bits set (0x0101, with a
__cpu_to_be16 to keep sparse happy) while accepting either set on input.

> Also both VTI and SIT are overloading the same bit which is an
> accident waiting to happen.  Since VTI is newer, I propose giving a
> different bit to VTI.

Indeed VTI is new in 3.6, so there is still a short window in which it's
fairly safe to tweak its ABI.

> The other alternative is keeping the same ABI, but putting a big note
> as to why it works in spite of our stupidity.
[...]

Does it even matter that different tunnel types have different meanings
for flags?

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html