netdev - Re: [PATCH ipsec] xfrm: Pass template address family to xfrm_state_look

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKkLME25zc21fvc_fatae-Lmzzr2sQfbNkqWSENGfoHa4rJpoQ@mail.gmail.com>
Date:   Tue, 3 Nov 2020 07:16:00 -0800
From:   Anthony DeRossi <ajderossi@...il.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     netdev@...r.kernel.org, steffen.klassert@...unet.com,
        davem@...emloft.net, kuba@...nel.org
Subject: Re: [PATCH ipsec] xfrm: Pass template address family to xfrm_state_look_at

On Tue, Nov 3, 2020 at 4:08 AM Herbert Xu <herbert@...dor.apana.org.au> wrote:
>
> On Mon, Nov 02, 2020 at 06:32:19PM -0800, Anthony DeRossi wrote:
> > This fixes a regression where valid selectors are incorrectly skipped
> > when xfrm_state_find is called with a non-matching address family (e.g.
> > when using IPv6-in-IPv4 ESP in transport mode).
>
> Why are we even allowing v6-over-v4 in transport mode? Isn't that
> the whole point of BEET mode?

I'm not sure. This is the outgoing policy that strongSwan creates for
an IPv6-in-IPv4 tunnel when compression is enabled:

src fd02::/16 dst fd02::2/128
        dir out priority 326271 ptype main
        tmpl src 10.0.0.8 dst 192.168.1.231
                proto comp spi 0x0000d00e reqid 1 mode tunnel
        tmpl src 0.0.0.0 dst 0.0.0.0
                proto esp spi 0xc543e950 reqid 1 mode transport

After your patch, outgoing IPv6 packets fail to match the associated state:

src 10.0.0.8 dst 192.168.1.231
        proto esp spi 0xc543e950 reqid 1 mode transport
        replay-window 0
        auth-trunc hmac(sha256)
0x143b570f59b23eaa560905f19a922451c6dfa5694ba2e45e1b065bb1863421aa 128
        enc cbc(aes) 0x526ed144ca087125ce30e36c8f20d972
        encap type espinudp sport 4501 dport 4500 addr 0.0.0.0
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0

Is this an invalid configuration?

Anthony