Skip to contentSkip to conversation

xfrm: Fix replay window size calculation on initialization

PATCH Applied Steffen Klassert 3 participants 13 messages Apr 26, 2011

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Steffen Klassert

author maintainer
#0 lore raw

PATCH 1/4 xfrm: Fix replay window size calculation on initialization

On replay initialization, we compute the size of the replay buffer to see if the replay window fits into the buffer. This computation lacks a mutliplication by 8 because we need the size in bit, not in byte. So we might return an error even though the replay window would fit into the buffer. This patch fixes this issue.

Signed-off-by Steffen Klassert <[email protected]>
---
 net/xfrm/xfrm_replay.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/xfrm/xfrm_replay.c +1 -1
index f218385..e8a7814 100644
@@ -532,7 +532,7 @@ int xfrm_init_replay(struct xfrm_state *x)
 
 	if (replay_esn) {
 		if (replay_esn->replay_window >
-		    replay_esn->bmp_len * sizeof(__u32))
+		    replay_esn->bmp_len * sizeof(__u32) * 8)
 			return -EINVAL;
 
 	if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
Signature · 1 line
1.7.0.4
author maintainer
#1 lore raw

PATCH 2/4 esp6: Fix scatterlist initialization

When we use IPsec extended sequence numbers, we may overwrite the last scatterlist of the associated data by the scatterlist for the skb. This patch fixes this by placing the scatterlist for the skb right behind the last scatterlist of the associated data. esp4 does it already like that.

Signed-off-by Steffen Klassert <[email protected]>
---
 net/ipv6/esp6.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/ipv6/esp6.c +1 -1
index 5aa8ec8..59dccfb 100644
@@ -371,7 +371,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
 	iv = esp_tmp_iv(aead, tmp, seqhilen);
 	req = esp_tmp_req(aead, iv);
 	asg = esp_req_sg(aead, req);
-	sg = asg + 1;
+	sg = asg + sglists;
 
 	skb->ip_summed = CHECKSUM_NONE;
Signature · 1 line
1.7.0.4
maintainer Acked-by on v1 2/4
#2 lore raw

Re: [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization

Quoted 7 lines · Steffen Klassert

When we use IPsec extended sequence numbers, we may overwrite the last scatterlist of the associated data by the scatterlist for the skb. This patch fixes this by placing the scatterlist for the skb right behind the last scatterlist of the associated data. esp4 does it already like that.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>
Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer Applied
#3 lore raw

Re: [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization

From: Herbert Xu <[email protected]>
Date: Tue, 26 Apr 2011 15:41:58 +1000

Quoted 10 lines · Steffen Klassert
Quoted 7 lines

When we use IPsec extended sequence numbers, we may overwrite the last scatterlist of the associated data by the scatterlist for the skb. This patch fixes this by placing the scatterlist for the skb right behind the last scatterlist of the associated data. esp4 does it already like that.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>

Applied.

author maintainer
#4 lore raw

PATCH 3/4 xfrm: Check for the new replay implementation if an esn state is inserted

In reply to Steffen Klassert

IPsec extended sequence numbers can be used only with the new anti-replay window implementation. So check if the new implementation is used if an esn state is inserted and return an error if it is not.

Signed-off-by Steffen Klassert <[email protected]>
---
 net/xfrm/xfrm_user.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
net/xfrm/xfrm_user.c +3 -0
index 5d1d60d..c658cb3 100644
@@ -124,6 +124,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
 {
 	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
 
+	if ((p->flags & XFRM_STATE_ESN) && !rt)
+		return -EINVAL;
+
 	if (!rt)
 		return 0;
Signature · 1 line
1.7.0.4
maintainer Acked-by on v1 3/4
#5 lore raw

Re: [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted

Quoted 5 lines · Steffen Klassert

IPsec extended sequence numbers can be used only with the new anti-replay window implementation. So check if the new implementation is used if an esn state is inserted and return an error if it is not.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>
Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer Applied
#6 lore raw

Re: [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted

From: Herbert Xu <[email protected]>
Date: Tue, 26 Apr 2011 15:43:04 +1000

Quoted 8 lines · Steffen Klassert
Quoted 5 lines

IPsec extended sequence numbers can be used only with the new anti-replay window implementation. So check if the new implementation is used if an esn state is inserted and return an error if it is not.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>

Applied.

maintainer Acked-by on v1 1/4
#7 lore raw
In reply to Steffen Klassert
Quoted 8 lines · Steffen Klassert

On replay initialization, we compute the size of the replay buffer to see if the replay window fits into the buffer. This computation lacks a mutliplication by 8 because we need the size in bit, not in byte. So we might return an error even though the replay window would fit into the buffer. This patch fixes this issue.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>
Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer Applied
#8 lore raw

From: Herbert Xu <[email protected]>
Date: Tue, 26 Apr 2011 15:41:07 +1000

Quoted 11 lines · Steffen Klassert
Quoted 8 lines

On replay initialization, we compute the size of the replay buffer to see if the replay window fits into the buffer. This computation lacks a mutliplication by 8 because we need the size in bit, not in byte. So we might return an error even though the replay window would fit into the buffer. This patch fixes this issue.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>

Applied.

author maintainer
#9 lore raw

PATCH 4/4 xfrm: Fix integer underrun on zero sized replay windows

In reply to Steffen Klassert

The check if the replay window is contained within one subspace or spans over two subspaces causes an unwanted integer underrun on zero sized replay windows when we subtract minus one. We fix this by changeing this check to avoid the subtraction.

Signed-off-by Steffen Klassert <[email protected]>
---
 net/xfrm/xfrm_replay.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/xfrm/xfrm_replay.c +1 -1
index e8a7814..19f94bb 100644
@@ -32,7 +32,7 @@ u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
 	seq_hi = replay_esn->seq_hi;
 	bottom = replay_esn->seq - replay_esn->replay_window + 1;
 
-	if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
+	if (likely(replay_esn->seq > replay_esn->replay_window)) {
 		/* A. same subspace */
 		if (unlikely(seq < bottom))
 			seq_hi++;
Signature · 1 line
1.7.0.4
maintainer Acked-by on v1 4/4
#10 lore raw

Re: [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows

Quoted 6 lines · Steffen Klassert

The check if the replay window is contained within one subspace or spans over two subspaces causes an unwanted integer underrun on zero sized replay windows when we subtract minus one. We fix this by changeing this check to avoid the subtraction.

Signed-off-by Steffen Klassert <[email protected]>
Acked-by Herbert Xu <[email protected]>
Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author maintainer
#11 lore raw

Re: [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows

In reply to Steffen Klassert
Quoted 5 lines · Steffen Klassert

The check if the replay window is contained within one subspace or spans over two subspaces causes an unwanted integer underrun on zero sized replay windows when we subtract minus one. We fix this by changeing this check to avoid the subtraction.

Don't apply this one, it does not fix the issue completely. I'll send a better one, sorry.

maintainer
#12 lore raw

Re: [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows

From: Steffen Klassert <[email protected]>
Date: Tue, 26 Apr 2011 12:58:40 +0200

Quoted 9 lines · Steffen Klassert
Quoted 5 lines

The check if the replay window is contained within one subspace or spans over two subspaces causes an unwanted integer underrun on zero sized replay windows when we subtract minus one. We fix this by changeing this check to avoid the subtraction.

Don't apply this one, it does not fix the issue completely. I'll send a better one, sorry.

Ok.