netdev - Wildcard destination address in SAs in SAD?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <4154E3A3-ED5F-4F12-A096-170C40E23ABA@iki.fi>
Date:	Wed, 10 Sep 2014 15:26:02 +0300
From:	Markus Stenberg <markus.stenberg@....fi>
To:	netdev@...r.kernel.org
Cc:	Markus Stenberg <markus.stenberg@....fi>
Subject: Wildcard destination address in SAs in SAD?

Let us assume I’m trying to implement RFC4552 (authentication/confidentiality for OSPFv3). What it specifies is basically per-port SA with AH and manual keying, of chosen granularity. As I am quite lazy, I would rather specify just one SA for whole set of routers I happen to manage, with fixed SPI and key material.

Currently, it simply is not possible to configure in sane way without using external daemon that would create SA for every destination a router wants to interact with. That is very suboptimal.

The xfrm code has already concept of ‘wildcard source’. I am proposing to extend the logic also to destinations, with which (for example) securing of all Babel traffic looks like this:

root@ir1:/# ip xfrm state
src :: dst ::
        proto esp spi 0x00000042 reqid 42 mode transport
        replay-window 0 
        auth-trunc hmac(md5) 0x666f6f00000000000000000000000000 96
        enc cbc(aes) 0x666f6f00000000000000000000000000
        sel src ::/0 dst ::/0 
root@ir1:/# ip xfrm policy
src ::/0 dst ff02::/16 proto udp dport 6696 
        dir out priority 0 
        tmpl src :: dst ::
                proto esp reqid 42 mode transport
src ::/0 dst fe80::/64 proto udp dport 6696 
        dir out priority 0 
        tmpl src :: dst ::
                proto esp reqid 42 mode transport
src ::/0 dst fe80::/64 proto esp 
        dir in priority 0 
        tmpl src :: dst ::
                proto 0 reqid 42 mode transport
src ::/0 dst ff02::/16 proto esp 
        dir in priority 0
        tmpl src :: dst ::
                proto 0 reqid 42 mode transport
root@ir1:/#

I wrote (fairly small) patch for this ( http://www.employees.org/~mstenber/x/0001-xfrm-Support-for-any-dst.patch ). But is this a good idea? The changes are just:

- change xfrm_state_addr_check to allow wildcard (any) 
- xfrm_state_lookup checks for both exact dst match, as well as wildcard dst match
- xfrm_state_find checks for exact, dst + src any, and dst/src any
- XFRM_STATE_WILDRECV caused SA to be ignored in some lookups, I don’t know why (it is helpful at times). so I removed the checks against it.

Cheers,

-Markus--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html