netdev - Re: [RFC PATCH v2 2/4] ppp_mppe: check coherency counter for out-of-order sequencing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <519BBF89.1040900@cogentembedded.com>
Date:	Tue, 21 May 2013 22:40:09 +0400
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	jorge@...2.net
CC:	netdev@...r.kernel.org, linux-ppp@...r.kernel.org
Subject: Re: [RFC PATCH v2 2/4] ppp_mppe: check coherency counter for out-of-order
 sequencing

Hello.

On 05/21/2013 10:18 PM, Jorge Boncompte [DTI2] wrote:

> From: "Jorge Boncompte [DTI2]" <jorge@...2.net>
>
> While testing a L2TP tunnel without sequencing with MPPE encryption in
> stateless mode noticed that after a packet was reordered the encapsulated
> traffic session was stuck but testing against a Cisco gear did work.
>
>  From RFC3078 "MPPE expects packets to be delivered in sequence".
>
> The thing it's that the ppp_mppe module treats the reorder as if the
> coherency counter did wrap and rekeys all the "missing" packets.
>
> The link layer protocol should deliver the packets in order but at least
> with this patch in place the decryption process survives some packet reorder.
>
> Signed-off-by: Jorge Boncompte [DTI2] <jorge@...2.net>
> ---
>   drivers/net/ppp/ppp_mppe.c |   23 ++++++++++++++++++++++-
>   1 file changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c
> index 9a1849a..97f4804 100644
> --- a/drivers/net/ppp/ppp_mppe.c
> +++ b/drivers/net/ppp/ppp_mppe.c
[...]
> @@ -547,6 +559,15 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
>   	 */
>   
>   	if (!state->stateful) {
> +		if (mppe_cmp_ccount(ccount, state->ccount) < 0) {
> +			if (net_ratelimit())
> +				printk(KERN_WARNING "%s[%d]: Dropping out-of-order "

     Why not pr_warn()?

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html