netdev - Re: [PATCH v2 ipsec-next] xfrm: Add possibility to set the default to block if we have no policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 21 Sep 2021 08:33:37 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Paul Cercueil <paul@...pouillou.net>
CC:     <antony.antony@...unet.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Christian Langrock <christian.langrock@...unet.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, <netdev@...r.kernel.org>,
        <list@...ndingux.net>
Subject: Re: [PATCH v2 ipsec-next] xfrm: Add possibility to set the default
 to block if we have no policy

On Sun, Sep 19, 2021 at 11:40:37PM +0100, Paul Cercueil wrote:
> Hi,
> 
> I think this patch was merged in v5.15-rc1, right?
> 
> "strace" fails to build because of this:
> 
> In file included from print_fields.h:12,
>                 from defs.h:1869,
>                 from netlink.c:10:
> static_assert.h:20:25: error: static assertion failed: "XFRM_MSG_MAPPING !=
> 0x26"
>   20 | # define static_assert _Static_assert
>      | ^~~~~~~~~~~~~~
> xlat/nl_xfrm_types.h:162:1: note: in expansion of macro 'static_assert'
>  162 | static_assert((XFRM_MSG_MAPPING) == (0x26), "XFRM_MSG_MAPPING !=
> 0x26");
>      | ^~~~~~~~~~~~~
> make[5]: *** [Makefile:5834: libstrace_a-netlink.o] Error 1

Thanks for the report!

This is already fixed in the ipsec tree with:

commit 844f7eaaed9267ae17d33778efe65548cc940205
Author: Eugene Syromiatnikov <esyr@...hat.com>
Date:   Sun Sep 12 14:22:34 2021 +0200

    include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage

    Commit 2d151d39073a ("xfrm: Add possibility to set the default to block
    if we have no policy") broke ABI by changing the value of the XFRM_MSG_MAPPING
    enum item, thus also evading the build-time check
    in security/selinux/nlmsgtab.c:selinux_nlmsg_lookup for presence of proper
    security permission checks in nlmsg_xfrm_perms.  Fix it by placing
    XFRM_MSG_SETDEFAULT/XFRM_MSG_GETDEFAULT to the end of the enum, right before
    __XFRM_MSG_MAX, and updating the nlmsg_xfrm_perms accordingly.

    Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
    References: https://lore.kernel.org/netdev/20210901151402.GA2557@altlinux.org/
    Signed-off-by: Eugene Syromiatnikov <esyr@...hat.com>
    Acked-by: Antony Antony <antony.antony@...unet.com>
    Acked-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>

It will likely go upstream this week.

Thanks!