netdev - [PATCH net-next] xfrm: Simplify SA looking up when using wildcard source address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 23 Sep 2013 17:18:37 +0800
From:	Fan Du <fan.du@...driver.com>
To:	<steffen.klassert@...unet.com>
CC:	<davem@...emloft.net>, <netdev@...r.kernel.org>
Subject: [PATCH net-next] xfrm: Simplify SA looking up when using wildcard source address

I'm not quite sure I get this "wildcard source address" right,
IMHO if a host needs to protect every traffic for a given remote host,
then the source address is wildcard address, i.e. all ZEROs.
(Please correct me if I'm bloodly wrong。。。)

Here is the argument if above statement stands true:
__xfrm4/6_state_addr_check is a four steps check, all we need to do
is checking whether the destination address match. Passing saddr from
flow is worst option, as the checking needs to reach the fourth step.

So, simply this process by only checking destination address only when
using wildcard source address for looking up SAs.

Signed-off-by: Fan Du <fan.du@...driver.com>
---
 include/net/xfrm.h    |   31 +++++++++++++++++++++++++++++++
 net/xfrm/xfrm_state.c |    2 +-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e253bf0..fdb9343 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1282,6 +1282,37 @@ xfrm_state_addr_check(const struct xfrm_state *x,
 }
 
 static __inline__ int
+__xfrm4_state_daddr_check(const struct xfrm_state *x,
+                                const xfrm_address_t *daddr)
+{
+        return ((daddr->a4 == x->id.daddr.a4) ? 1 : 0);
+}
+
+static __inline__ int
+__xfrm6_state_daddr_check(const struct xfrm_state *x,
+                         const xfrm_address_t *daddr)
+{
+        if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr))
+                return 1;
+        else 
+                return 0;
+}
+
+static __inline__ int
+xfrm_state_daddr_check(const struct xfrm_state *x,
+                      const xfrm_address_t *daddr,
+                      unsigned short family)
+{
+        switch (family) {
+        case AF_INET:
+                return __xfrm4_state_daddr_check(x, daddr);
+        case AF_INET6:
+                return __xfrm6_state_daddr_check(x, daddr);
+        }    
+        return 0;
+}
+
+static __inline__ int
 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
 			   unsigned short family)
 {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e1373d5..87c99da 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -824,7 +824,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 		    x->props.reqid == tmpl->reqid &&
 		    (mark & x->mark.m) == x->mark.v &&
 		    !(x->props.flags & XFRM_STATE_WILDRECV) &&
-		    xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
+		    xfrm_state_daddr_check(x, daddr, encap_family) &&
 		    tmpl->mode == x->props.mode &&
 		    tmpl->id.proto == x->id.proto &&
 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html