netdev - Re: [PATCH v5 ipsec-next] xfrm: introduce forwarding of ICMP Error messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZZZ80QrAwSyBxzxb@gauss3.secunet.de>
Date: Thu, 4 Jan 2024 10:39:29 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Antony Antony <antony.antony@...unet.com>
CC: Herbert Xu <herbert@...dor.apana.org.au>, "David S. Miller"
	<davem@...emloft.net>, <devel@...ux-ipsec.org>, Jakub Kicinski
	<kuba@...nel.org>, <netdev@...r.kernel.org>
Subject: Re: [PATCH v5 ipsec-next] xfrm: introduce forwarding of ICMP Error
 messages

On Fri, Dec 22, 2023 at 01:57:04PM +0100, Antony Antony wrote:
> +
>  int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
>  			unsigned short family)
>  {
> @@ -3549,9 +3672,17 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
> 
>  		for (i = sp->len - 1; i >= 0; i--) {
>  			struct xfrm_state *x = sp->xvec[i];
> +			int ret = 0;
> +
>  			if (!xfrm_selector_match(&x->sel, &fl, family)) {
> -				XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH);
> -				return 0;
> +				ret = true;
> +				if (x->props.flags & XFRM_STATE_ICMP &&
> +				    xfrm_selector_inner_icmp_match(skb, family, &x->sel, &fl))
> +					ret = false;

__xfrm_policy_check returns int, not bool. Please fix these
return values.