netdev - Re: [PATCH ipsec-next] xfrm: policy: fix netlink/pf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181120073650.GD3581@gauss3.secunet.de>
Date:   Tue, 20 Nov 2018 08:36:50 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Florian Westphal <fw@...len.de>
CC:     <netdev@...r.kernel.org>, <colin.king@...onical.com>
Subject: Re: [PATCH ipsec-next] xfrm: policy: fix netlink/pf_key policy
 lookups

On Thu, Nov 15, 2018 at 02:51:57AM +0100, Florian Westphal wrote:
> Colin Ian King says:
>  Static analysis with CoverityScan found a potential issue [..]
>  It seems that pointer pol is set to NULL and then a check to see if it
>  is non-null is used to set pol to tmp; howeverm this check is always
>  going to be false because pol is always NULL.
> 
> Fix this and update test script to catch this.  Updated script only:
> ./xfrm_policy.sh ; echo $?
> RTNETLINK answers: No such file or directory
> FAIL: ip -net ns3 xfrm policy get src 10.0.1.0/24 dst 10.0.2.0/24 dir out
> RTNETLINK answers: No such file or directory
> [..]
> PASS: policy before exception matches
> PASS: ping to .254 bypassed ipsec tunnel
> PASS: direct policy matches
> PASS: policy matches
> 1
> 
> Fixes: 6be3b0db6db ("xfrm: policy: add inexact policy search tree infrastructure")
> Reported-by: Colin Ian King <colin.king@...onical.com>
> Signed-off-by: Florian Westphal <fw@...len.de>

Applied, thanks everyone!