netdev - [PATCH 3/7] ip-xfrm: support 'proto any' with 'sport' and 'dport'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1428933661-8193-3-git-send-email-pavlix@pavlix.net>
Date:	Mon, 13 Apr 2015 16:00:57 +0200
From:	Pavel Šimerda <pavlix@...lix.net>
To:	netdev@...r.kernel.org
Cc:	stephen@...workplumber.org, psimerda@...hat.com
Subject: [PATCH 3/7] ip-xfrm: support 'proto any' with 'sport' and 'dport'

From: Pavel Šimerda <psimerda@...hat.com>

When creating an IPsec SA that sets 'proto any' (IPPROTO_IP) and
specifies 'sport' and 'dport' at the same time in selector, the
following error is issued:

"sport" and "dport" are invalid with proto=ip

However using IPPROTO_IP with ports is completely legal and necessary
when one wants to share the SA on both TCP and UDP. One of the
applications requiring sharing SAs is 3GPP IMS AKA authentication.

See also:

 * https://bugzilla.redhat.com/show_bug.cgi?id=497355

Reported-by: Jiří Klimeš <jklimes@...hat.com>
Signed-off-by: Pavel Šimerda <psimerda@...hat.com>
---
 ip/ipxfrm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 95f91a5..e685571 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -1339,6 +1339,7 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel,
 		case IPPROTO_UDP:
 		case IPPROTO_SCTP:
 		case IPPROTO_DCCP:
+		case IPPROTO_IP: /* to allow shared SA for different protocols */
 			break;
 		default:
 			fprintf(stderr, "\"sport\" and \"dport\" are invalid with PROTO value \"%s\"\n", strxf_proto(sel->proto));
-- 
2.3.5

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html