netdev - Re: [PATCH net] drivers: net: Fix *_ipsec_offload_ok(): Use ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <234b8fbd-713d-5745-9a7b-ca9d002b95e1@secunet.com>
Date:   Mon, 21 Sep 2020 08:22:06 +0200
From:   Christian Langrock <christian.langrock@...unet.com>
To:     "David S. Miller" <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <jeffrey.t.kirsher@...el.com>, <kuba@...nel.org>,
        <borisp@...dia.com>
Subject: Re: [PATCH net] drivers: net: Fix *_ipsec_offload_ok(): Use ip_hdr
 family

Hello David,

I saw the status of my patched has been changed to "Changes requested".

Can you tell me what can I do to get the patch accepted?

Thank you in advance!

BR,

Christian

Am 17.09.20 um 14:27 schrieb Christian Langrock:
> Xfrm_dev_offload_ok() is called with the unencrypted SKB. So in case of
> interfamily ipsec traffic (IPv4-in-IPv6 and IPv6 in IPv4) the check
> assumes the wrong family of the skb (IP family of the state).
> With this patch the ip header of the SKB is used to determine the
> family.
>
> Signed-off-by: Christian Langrock <christian.langrock@...unet.com>
> ---
>  drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c           | 2 +-
>  drivers/net/ethernet/intel/ixgbevf/ipsec.c               | 2 +-
>  drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 2 +-
>  3 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> index eca73526ac86..3601dd293463 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
> @@ -813,7 +813,7 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs)
>   **/
>  static bool ixgbe_ipsec_offload_ok(struct sk_buff *skb, struct
> xfrm_state *xs)
>  {
> -       if (xs->props.family == AF_INET) {
> +       if (ip_hdr(skb)->version == 4) {
>                 /* Offload with IPv4 options is not supported yet */
>                 if (ip_hdr(skb)->ihl != 5)
>                         return false;
> diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> index 5170dd9d8705..b1d72d5d1744 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> +++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
> @@ -418,7 +418,7 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs)
>   **/
>  static bool ixgbevf_ipsec_offload_ok(struct sk_buff *skb, struct
> xfrm_state *xs)
>  {
> -       if (xs->props.family == AF_INET) {
> +       if (ip_hdr(skb)->version == 4) {
>                 /* Offload with IPv4 options is not supported yet */
>                 if (ip_hdr(skb)->ihl != 5)
>                         return false;
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> index d39989cddd90..e3a9b313b01f 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> @@ -460,7 +460,7 @@ void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv)
>  
>  static bool mlx5e_ipsec_offload_ok(struct sk_buff *skb, struct
> xfrm_state *x)
>  {
> -       if (x->props.family == AF_INET) {
> +       if (ip_hdr(skb)->version == 4) {
>                 /* Offload with IPv4 options is not supported yet */
>                 if (ip_hdr(skb)->ihl > 5)
>                         return false;

-- 
Dipl.-Inf.(FH) Christian Langrock
Senior Consultant
Network & Client Security
Division Public Authorities
secunet Security Networks AG 


Phone: +49 201 5454-3833 
E-Mail: christian.langrock@...unet.com

Ammonstraße 74 
01067 Dresden, Germany
www.secunet.com

______________________________________________________________________

Registered at: Kurfuerstenstrasse 58, 45138 Essen, Germany 
Amtsgericht Essen HRB 13615
Management Board: Dr Rainer Baumgart (CEO), Thomas Pleines 
Chairman of Supervisory Board: Ralf Wintergerst
______________________________________________________________________


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)