netdev - Re: [PATCH] ip/xfrm: Fix deleteall when having many policies installed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Jan 2017 09:00:59 +0100
From:   Alexander Heinlein <alexander.heinlein@...unet.com>
To:     Stephen Hemminger <stephen@...workplumber.org>
CC:     <netdev@...r.kernel.org>
Subject: Re: [PATCH] ip/xfrm: Fix deleteall when having many policies
 installed

On 01/17/2017 05:44 PM, Stephen Hemminger wrote:
> What happens when many many policies are installed?
> It looks like your patch would silently stop deleting.
> Does the the code flush all of them?

Yes, it flushes all of them. xfrm_policy_list_or_deleteall() performs
multiple rounds until there are no more policies left to delete
(xb.nlmsg_count becomes 0).

The previous code failed with
> Policy buffer overflow
> Delete-all terminated
upon reaching the end of the buffer. This already happens for 102
policies on my system.

The new code fills the buffer, sends the corresponding netlink message
and then re-checks for remaining policies to delete.

You can check the old and new behavior via the following commands:
# for((i=0;i<255;++i)); do ip x p a src 0.0.0.$i dst 127.0.0.0/24 dev lo
dir out action allow priority 10000; done
# ip -s -s x p deleteall action allow priority 10000

Regards
Alex