netdev - Re: [PATCH net] xfrm: Guard IPsec anti replay window against replay bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130917065647.GO7660@secunet.com>
Date:	Tue, 17 Sep 2013 08:56:47 +0200
From:	Steffen Klassert <steffen.klassert@...unet.com>
To:	Fan Du <fan.du@...driver.com>
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH net] xfrm: Guard IPsec anti replay window against replay
 bitmap

On Tue, Sep 17, 2013 at 02:26:05PM +0800, Fan Du wrote:
> 
> diff --git a/net/key/af_key.c b/net/key/af_key.c
> index 9d58537..911ef03 100644
> --- a/net/key/af_key.c
> +++ b/net/key/af_key.c
> @@ -1098,7 +1098,8 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
>  
>  	x->id.proto = proto;
>  	x->id.spi = sa->sadb_sa_spi;
> -	x->props.replay_window = sa->sadb_sa_replay;
> +	x->props.replay_window = min_t(unsigned int, sa->sadb_sa_replay,
> +					(sizeof(x->replay.bitmap) * 8));
>  	if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
>  		x->props.flags |= XFRM_STATE_NOECN;
>  	if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
> diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
> index 8dafe6d3..eeca388 100644
> --- a/net/xfrm/xfrm_replay.c
> +++ b/net/xfrm/xfrm_replay.c
> @@ -129,8 +129,7 @@ static int xfrm_replay_check(struct xfrm_state *x,
>  		return 0;
>  
>  	diff = x->replay.seq - seq;
> -	if (diff >= min_t(unsigned int, x->props.replay_window,
> -			  sizeof(x->replay.bitmap) * 8)) {
> +	if (diff >= x->props.replay_window) {

So x->props.replay_window will be valid if the state was added with the
pfkey interface, but what if the netlink interface was used? You should
also update the netlink part to always hold a valid replay window.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html