netdev - Re: ip xfrm delete / deleteall not able to delete SAs with SPI=0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 24 Dec 2021 10:16:05 +0100
From:   Harald Welte <laforge@...monks.org>
To:     netdev@...r.kernel.org
Subject: Re: ip xfrm delete / deleteall not able to delete SAs with SPI=0

Hi again,

I did a bit more testing and the problem seems to occur with SPI=0,
i.e. the kernel permits a SA for SPI=0 to be created via netlink, but then
it somehow fails to allow that to be deleted again via netlink, and it will
be stuck until the user manually flushes all SAs.

To be fair, RFC4303 says "The SPI value of zero (0) is reserved for local,
implementation-specific use and MUST NOT be sent on the wire"

However, despite that, I think the kernel should ether

a) reject creation of any SA with SPI=0

b) if it accepts a SA with SPI=0 in NEWSA, it should equally accept
   the symmetric DELSA operation with SP=0

-- 
- Harald Welte <laforge@...monks.org>           http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
                                                  (ETSI EN 300 175-7 Ch. A6)