netdev - Re: [PATCH ipsec] xfrm: Ensure consistent address families when resolving templates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8b8dbbc4-f956-8cbf-3700-1da366357a6f@strongswan.org>
Date:   Tue, 25 Apr 2023 10:00:32 +0200
From:   Tobias Brunner <tobias@...ongswan.org>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     Steffen Klassert <steffen.klassert@...unet.com>,
        netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>
Subject: Re: [PATCH ipsec] xfrm: Ensure consistent address families when
 resolving templates

Hi Herbert,

> I'm confused.  By skipping, you're presumably referring to IPcomp.
> 
> For IPcomp, skipping should only occur on inbound, but your patch
> is changing a code path that's only invoked for outbound.  What's
> going on?

At least in theory, there could be applications for optional outbound 
templates, e.g. an optional ESP transform that's only applied to some of 
the traffic matching the policy (based on the selector on the state, 
which is matched against the original flow) followed by a mandatory AH 
transform (there could even be multiple optional transforms, e.g. using 
different algorithms, that are selectively applied to traffic).  No idea 
if anybody actually uses this, but the API allows configuring it.  And 
syzbot showed that some combinations are problematic.

Regards,
Tobias