netdev - Re: [PATCH ipsec-next v2] xfrm: policy: fix layer 4 flowi decoding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 28 Oct 2023 10:31:04 +0200
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Florian Westphal <fw@...len.de>
CC: <netdev@...r.kernel.org>, <herbert@...dor.apana.org.au>, Antony Antony
	<antony@...nome.org>
Subject: Re: [PATCH ipsec-next v2] xfrm: policy: fix layer 4 flowi decoding

On Thu, Oct 26, 2023 at 04:45:42PM +0200, Florian Westphal wrote:
> The commit shipped with two bugs:
>  fl4->fl4_icmp_type = flkeys->icmp.type;
>  fl4->fl4_icmp_type = flkeys->icmp.code;
>                ~~~~ should have been "code".
> 
> But the more severe bug is that I got fooled by flowi member defines:
> fl4_icmp_type, fl4_gre_key and fl4_dport share the same union/address.
> 
> Fix typo and make gre/icmp key setting depend on the l4 protocol.
> 
> Fixes: 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector")
> Reported-and-tested-by: Antony Antony <antony@...nome.org>
> Signed-off-by: Florian Westphal <fw@...len.de>
> ---
>  v2: decode_session6 must use IPPROTO_ICMPV6, not IPPROTO_ICMP.
> 
>  I normally do not resend immediately but in this case it seems like the
>  lesser evil. 

This was indeed the better way to do it.

Applied, thanks a lot!