lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20190521122238.qip43s44pgl7ihea@gondor.apana.org.au> Date: Tue, 21 May 2019 20:22:38 +0800 From: Herbert Xu <herbert@...dor.apana.org.au> To: Anirudh Gupta <anirudhrudr@...il.com> Cc: Steffen Klassert <steffen.klassert@...unet.com>, Anirudh Gupta <anirudh.gupta@...hos.com>, "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH net] xfrm: Fix xfrm sel prefix length validation On Tue, May 21, 2019 at 01:52:47PM +0530, Anirudh Gupta wrote: > Family of src/dst can be different from family of selector src/dst. > Use xfrm selector family to validate address prefix length, > while verifying new sa from userspace. > > Validated patch with this command: > ip xfrm state add src 1.1.6.1 dst 1.1.6.2 proto esp spi 4260196 \ > reqid 20004 mode tunnel aead "rfc4106(gcm(aes))" \ > 0x1111016400000000000000000000000044440001 128 \ > sel src 1011:1:4::2/128 sel dst 1021:1:4::2/128 dev Port5 > > Fixes: 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") > Signed-off-by: Anirudh Gupta <anirudh.gupta@...hos.com> > --- > net/xfrm/xfrm_user.c | 17 +++++++++++++++++ > 1 file changed, 17 insertions(+) > > diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c > index eb8d14389601..1d1fe2208ab5 100644 > --- a/net/xfrm/xfrm_user.c > +++ b/net/xfrm/xfrm_user.c > @@ -150,6 +150,23 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, > > err = -EINVAL; > switch (p->family) { > + case AF_INET: > + break; > + > + case AF_INET6: > +#if IS_ENABLED(CONFIG_IPV6) > + break; > +#else > + err = -EAFNOSUPPORT; > + goto out; > +#endif > + > + default: > + goto out; > + } > + > + err = -EINVAL; This is not needed because you already set it at the start. Otherwise this looks good to me. Thanks, -- Email: Herbert Xu <herbert@...dor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Powered by blists - more mailing lists