netdev - Re: [PATCH net-next 0/2] netfilter: IPv4/v6 IPcomp match support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131223121337.GA5373@localhost>
Date:	Mon, 23 Dec 2013 13:13:37 +0100
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Fan Du <fan.du@...driver.com>
Cc:	davem@...emloft.net, steffen.klassert@...unet.com,
	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH net-next 0/2] netfilter: IPv4/v6 IPcomp match support

Hi,

On Fri, Dec 20, 2013 at 05:21:05PM +0800, Fan Du wrote:
[...]
> >AH is not the last header, so we still have to use ipv6_find_hdr() to
> >find the good header instead of par->thoff. Note that the ip6_tables
> >sets par->thoff to the last IPv6 extension header.
> 
> I'm quite new to the internal of netfiler, especially about this part.
> I will take a look at the code later.
> 
> >This rises some concerns regarding your ipcomp, I think that if you
> >use this with ah and esp, the ordering of the headers is
> >ah+ipcomp+esp, right?
> 
> This depends on the user land configuration of encapsulation order.
> It can be one of the three types only(ah, esp, ipcomp), the most commonly
> used is ah(outer)+esp(inner).
> 
> I barely see ipcomp used in production, but I remember RFC says ipcomp
> should be done first before esp, because after encryption in esp, the data
> is polluted, i.e., not suitable for compressed anymore(I'm not sure the
> details theory behind this statement.)

In that case we have to use ipv6_find_hdr(..., IPPROTO_IPCOMP, ...),
since par->thoff will point to the last header which is esp. After
this change, the ipcomp ipv6 match will look very similar to what you
have in ah_mt6(...) in net/ipv6/netfilter/ip6t_ah.c. Please, rework
that in your ipcomp match patch and resend. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html