lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1476715422-19151-2-git-send-email-david.lebrun@uclouvain.be> Date: Mon, 17 Oct 2016 16:43:39 +0200 From: David Lebrun <david.lebrun@...ouvain.be> To: <netdev@...r.kernel.org> CC: David Lebrun <david.lebrun@...ouvain.be> Subject: [PATCH 6/9] ipv6: sr: add calls to verify and insert HMAC signatures This patch enables the verification of the HMAC signature for transiting SR-enabled packets, and its insertion on encapsulated/injected SRH. Signed-off-by: David Lebrun <david.lebrun@...ouvain.be> --- net/ipv6/exthdrs.c | 6 ++++++ net/ipv6/seg6_iptunnel.c | 13 +++++++++++++ 2 files changed, 19 insertions(+) diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c index b31f811..73b3743 100644 --- a/net/ipv6/exthdrs.c +++ b/net/ipv6/exthdrs.c @@ -49,6 +49,7 @@ #endif #ifdef CONFIG_IPV6_SEG6 #include <linux/seg6.h> +#include <net/seg6_hmac.h> #endif #include <linux/uaccess.h> @@ -313,6 +314,11 @@ static int ipv6_srh_rcv(struct sk_buff *skb) return -1; } + if (!seg6_hmac_validate_skb(skb)) { + kfree_skb(skb); + return -1; + } + looped_back: last_addr = hdr->segments; diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 461375c..a32a7ff 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -109,12 +109,19 @@ static int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) hdr->daddr = isrh->segments[isrh->first_segment]; set_tun_src(net, skb->dev, &hdr->daddr, &hdr->saddr); + if (sr_get_flags(isrh) & SR6_FLAG_HMAC) { + err = seg6_push_hmac(net, &hdr->saddr, isrh); + if (unlikely(err)) + return err; + } + return 0; } /* insert an SRH within an IPv6 packet, just after the IPv6 header */ static int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) { + struct net *net = dev_net(skb_dst(skb)->dev); struct ipv6hdr *hdr, *oldhdr; struct ipv6_sr_hdr *isrh; int hdrlen, err; @@ -144,6 +151,12 @@ static int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) isrh->segments[0] = hdr->daddr; hdr->daddr = isrh->segments[isrh->first_segment]; + if (sr_get_flags(isrh) & SR6_FLAG_HMAC) { + err = seg6_push_hmac(net, &hdr->saddr, isrh); + if (unlikely(err)) + return err; + } + return 0; } -- 2.7.3
Powered by blists - more mailing lists