netdev - Re: [PATCH net] ipv6: Don't use ufo handling on later transformed packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 31 Oct 2016 13:12:14 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     jkbs@...hat.com
Cc:     netdev@...r.kernel.org, hannes@...essinduktion.org, fw@...len.de
Subject: Re: [PATCH net] ipv6: Don't use ufo handling on later transformed
 packets

From: Jakub Sitnicki <jkbs@...hat.com>
Date: Wed, 26 Oct 2016 11:21:14 +0200

> Similar to commit c146066ab802 ("ipv4: Don't use ufo handling on later
> transformed packets"), don't perform UFO on packets that will be IPsec
> transformed. To detect it we rely on the fact that headerlen in
> dst_entry is non-zero only for transformation bundles (xfrm_dst
> objects).
> 
> Unwanted segmentation can be observed with a NETIF_F_UFO capable device,
> such as a dummy device:
> 
>   DEV=dum0 LEN=1493
> 
>   ip li add $DEV type dummy
>   ip addr add fc00::1/64 dev $DEV nodad
>   ip link set $DEV up
>   ip xfrm policy add dir out src fc00::1 dst fc00::2 \
>      tmpl src fc00::1 dst fc00::2 proto esp spi 1
>   ip xfrm state add src fc00::1 dst fc00::2 \
>      proto esp spi 1 enc 'aes' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
> 
>   tcpdump -n -nn -i $DEV -t &
>   socat /dev/zero,readbytes=$LEN udp6:[fc00::2]:$LEN
> 
> tcpdump output before:
> 
>   IP6 fc00::1 > fc00::2: frag (0|1448) ESP(spi=0x00000001,seq=0x1), length 1448
>   IP6 fc00::1 > fc00::2: frag (1448|48)
>   IP6 fc00::1 > fc00::2: ESP(spi=0x00000001,seq=0x2), length 88
> 
> ... and after:
> 
>   IP6 fc00::1 > fc00::2: frag (0|1448) ESP(spi=0x00000001,seq=0x1), length 1448
>   IP6 fc00::1 > fc00::2: frag (1448|80)
> 
> Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")
> 
> Signed-off-by: Jakub Sitnicki <jkbs@...hat.com>
> Acked-by: Hannes Frederic Sowa <hannes@...essinduktion.org>

Applied, thank you.