netdev - Re: [PATCH net] ipv4: fill fl4_icmp_{type,code} in ping_v4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 07 Jul 2020 15:27:15 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     sd@...asysnail.net
Cc:     netdev@...r.kernel.org, pwouters@...hat.com
Subject: Re: [PATCH net] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg

From: Sabrina Dubroca <sd@...asysnail.net>
Date: Fri,  3 Jul 2020 17:00:32 +0200

> IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to
> incomplete IPsec ACQUIRE messages being sent to userspace. Currently,
> both raw sockets and IPv6 ping sockets set those fields.
> 
> Expected output of "ip xfrm monitor":
>     acquire proto esp
>       sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4
>       policy src 10.0.2.15/32 dst 8.8.8.8/32
>         <snip>
> 
> Currently with ping sockets:
>     acquire proto esp
>       sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4
>       policy src 10.0.2.15/32 dst 8.8.8.8/32
>         <snip>
> 
> The Libreswan test suite found this problem after Fedora changed the
> value for the sysctl net.ipv4.ping_group_range.
> 
> Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
> Reported-by: Paul Wouters <pwouters@...hat.com>
> Tested-by: Paul Wouters <pwouters@...hat.com>
> Signed-off-by: Sabrina Dubroca <sd@...asysnail.net>

Applied and queued up for -stable, thank you.