netdev - Re: [PATCH ipsec-next v3 0/3] xfrm: policy: replace session decode with flow dissector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZTp4dDaWejic16eT@moon.secunet.de>
Date: Thu, 26 Oct 2023 16:33:22 +0200
From: Antony Antony <antony.antony@...unet.com>
To: Florian Westphal <fw@...len.de>
CC: Antony Antony <antony@...nome.org>, Steffen Klassert
	<steffen.klassert@...unet.com>, <netdev@...r.kernel.org>,
	<herbert@...dor.apana.org.au>
Subject: Re: [PATCH ipsec-next v3 0/3] xfrm: policy: replace session decode
 with flow dissector

On Thu, Oct 26, 2023 at 14:57:48 +0200, Florian Westphal wrote:
> Antony Antony <antony@...nome.org> wrote:
> > > > Florian Westphal (3):
> > > >   xfrm: pass struct net to xfrm_decode_session wrappers
> > > >   xfrm: move mark and oif flowi decode into common code
> > > >   xfrm: policy: replace session decode with flow dissector
> > > 
> > > Series applied, thanks a lot Florian!
> > > 
> > 
> > Hi Steffen,
> > 
> > I would like to report a potential bug that I've encountered while working
> 
> s/potential//
> 
> Does this patch make things work for you again?  Thanks!
> 
> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index 6aea8b2f45e0..e8c406eba11b 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -3400,11 +3400,18 @@ decode_session4(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve
>  		fl4->fl4_dport = flkeys->ports.dst;
>  	}
>  
> +	switch (flkeys->basic.ip_proto) {
> +	case IPPROTO_GRE:
> +		fl4->fl4_gre_key = flkeys->gre.keyid;
> +		break;
> +	case IPPROTO_ICMP:
> +		fl4->fl4_icmp_type = flkeys->icmp.type;
> +		fl4->fl4_icmp_code = flkeys->icmp.code;
> +		break;
> +	}
> +
>  	fl4->flowi4_proto = flkeys->basic.ip_proto;
>  	fl4->flowi4_tos = flkeys->ip.tos;
> -	fl4->fl4_icmp_type = flkeys->icmp.type;
> -	fl4->fl4_icmp_type = flkeys->icmp.code;
> -	fl4->fl4_gre_key = flkeys->gre.keyid;
>  }
>  
>  #if IS_ENABLED(CONFIG_IPV6)
> @@ -3427,10 +3434,17 @@ decode_session6(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve
>  		fl6->fl6_dport = flkeys->ports.dst;
>  	}
>  
> +	switch (flkeys->basic.ip_proto) {
> +	case IPPROTO_GRE:
> +		fl6->fl6_gre_key = flkeys->gre.keyid;
> +		break;
> +	case IPPROTO_ICMP:
> +		fl6->fl6_icmp_type = flkeys->icmp.type;
> +		fl6->fl6_icmp_code = flkeys->icmp.code;
> +		break;
> +	}
> +
>  	fl6->flowi6_proto = flkeys->basic.ip_proto;
> -	fl6->fl6_icmp_type = flkeys->icmp.type;
> -	fl6->fl6_icmp_type = flkeys->icmp.code;
> -	fl6->fl6_gre_key = flkeys->gre.keyid;
>  }
>  #endif
>  

Tested-by: Antony Antony <antony.antony@...unet.com>

Thanks,
-antony