netdev - Re: [PATCH] udp: avoid ufo handling on IP payload compression packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170307070150.GA25144@gondor.apana.org.au>
Date:   Tue, 7 Mar 2017 15:01:50 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Steffen Klassert <steffen.klassert@...unet.com>
Cc:     Alexey Kodanev <alexey.kodanev@...cle.com>, netdev@...r.kernel.org,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH] udp: avoid ufo handling on IP payload compression packets

On Mon, Mar 06, 2017 at 07:16:57AM +0100, Steffen Klassert wrote:
>
> > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> > index b67719f..18383ef 100644
> > --- a/net/ipv4/ip_output.c
> > +++ b/net/ipv4/ip_output.c
> > @@ -960,7 +960,10 @@ static int __ip_append_data(struct sock *sk,
> >  	cork->length += length;
> >  	if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
> >  	    (sk->sk_protocol == IPPROTO_UDP) &&
> > -	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
> > +	    (rt->dst.dev->features & NETIF_F_UFO) &&
> > +#ifdef CONFIG_XFRM
> > +	    !rt->dst.xfrm &&
> > +#endif
> 
> Please fix IPcomp to use rt->dst.header_len instead off adding
> this ifdef to the generic networking code.

It's not that simple though.  IPComp's header_len is set to zero
because we opportunistically drop the IPComp header when the total
compressed length exceeds the original packet length.  That is,
we only ever do IPComp when it does not cause the packet to expand.

So it seems that we need another way of indicating the presence of
XFRM.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt