netdev - Re: [Patch net] xfrm: unify xfrm protocol checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Mar 2019 13:42:53 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        syzbot+0bf0519d6e0de15914fe@...kaller.appspotmail.com,
        Steffen Klassert <steffen.klassert@...unet.com>
Subject: Re: [Patch net] xfrm: unify xfrm protocol checks

On Mon, Mar 18, 2019 at 10:17 PM Herbert Xu <herbert@...dor.apana.org.au> wrote:
>
> On Mon, Mar 18, 2019 at 10:08:24PM -0700, Cong Wang wrote:
> >
> > +static inline bool xfrm_id_proto_valid(u8 proto)
> > +{
> > +     switch (proto) {
> > +     case IPPROTO_AH:
> > +     case IPPROTO_ESP:
> > +     case IPPROTO_COMP:
> > +#if IS_ENABLED(CONFIG_IPV6)
> > +     case IPPROTO_ROUTING:
> > +     case IPPROTO_DSTOPTS:
> > +#endif
> > +     case IPSEC_PROTO_ANY:
> > +             return true;
> > +     default:
> > +             return false;
> > +     }
> > +}
> > +
> >  static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
> >  {
> >       return (!userproto || proto == userproto ||
> > -             (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
> > -                                               proto == IPPROTO_ESP ||
> > -                                               proto == IPPROTO_COMP)));
> > +             (userproto == IPSEC_PROTO_ANY && xfrm_id_proto_valid(proto)));
> >  }
>
> This does not look right.  IPSEC_PROTO_ANY should only be allowed
> in userproto and your patch is going to let it pass when it's in
> proto.  Whether IPPROTO_ROUTING/IPPROTO_DSTOPTS should be allowed
> in this context is also not obvious.

IIRC, it is Steffen who suggested to add IPPROTO_ROUTING/IPPROTO_DSTOPTS
back to commit 6a53b7593233. My xfrm knowledge is not enough to
figure out IPPROTO_ROUTING/IPPROTO_DSTOPTS.

I just assume validate_tmpl() is correct.