lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 09 Mar 2017 18:29:08 -0800 (PST) From: David Miller <davem@...emloft.net> To: alexey.kodanev@...cle.com Cc: netdev@...r.kernel.org, steffen.klassert@...unet.com, herbert@...dor.apana.org.au Subject: Re: [PATCH v2] udp: avoid ufo handling on IP payload compression packets From: Alexey Kodanev <alexey.kodanev@...cle.com> Date: Thu, 9 Mar 2017 13:56:46 +0300 > commit c146066ab802 ("ipv4: Don't use ufo handling on later transformed > packets") and commit f89c56ce710a ("ipv6: Don't use ufo handling on > later transformed packets") added a check that 'rt->dst.header_len' isn't > zero in order to skip UFO, but it doesn't include IPcomp in transport mode > where it equals zero. > > Packets, after payload compression, may not require further fragmentation, > and if original length exceeds MTU, later compressed packets will be > transmitted incorrectly. This can be reproduced with LTP udp_ipsec.sh test > on veth device with enabled UFO, MTU is 1500 and UDP payload is 2000: > > * IPv4 case, offset is wrong + unnecessary fragmentation > udp_ipsec.sh -p comp -m transport -s 2000 & > tcpdump -ni ltp_ns_veth2 > ... > IP (tos 0x0, ttl 64, id 45203, offset 0, flags [+], > proto Compressed IP (108), length 49) > 10.0.0.2 > 10.0.0.1: IPComp(cpi=0x1000) > IP (tos 0x0, ttl 64, id 45203, offset 1480, flags [none], > proto UDP (17), length 21) 10.0.0.2 > 10.0.0.1: ip-proto-17 > > * IPv6 case, sending small fragments > udp_ipsec.sh -6 -p comp -m transport -s 2000 & > tcpdump -ni ltp_ns_veth2 > ... > IP6 (flowlabel 0x6b9ba, hlim 64, next-header Compressed IP (108) > payload length: 37) fd00::2 > fd00::1: IPComp(cpi=0x1000) > IP6 (flowlabel 0x6b9ba, hlim 64, next-header Compressed IP (108) > payload length: 21) fd00::2 > fd00::1: IPComp(cpi=0x1000) > > Fix it by checking 'rt->dst.xfrm' pointer to 'xfrm_state' struct, skip UFO > if xfrm is set. So the new check will include both cases: IPcomp and IPsec. > > Fixes: c146066ab802 ("ipv4: Don't use ufo handling on later transformed packets") > Fixes: f89c56ce710a ("ipv6: Don't use ufo handling on later transformed packets") > Signed-off-by: Alexey Kodanev <alexey.kodanev@...cle.com> > --- > > v2: use dst_xfrm() to access xfrm_state Applied and queued up for -stable, thanks!
Powered by blists - more mailing lists