net-xfrm: add build time cfg option to PF_KEY SHA256 to use RFC4868-compliant truncation
Subsystems (3)
PATCH 1/1 net-xfrm: add build time cfg option to PF_KEY SHA256 to use RFC4868-compliant truncation
From: Maciej Żenczykowski <[email protected]>
When using the PF_KEY interface, SHA-256 hashes are hardcoded to use 96-bit truncation. This is a violation of RFC4868, which specifies 128-bit truncation.
We cannot fix this without introducing backwards compatibility concerns unless we make it an optional build time setting (defaulting to no). Android will default to yes instead of carrying an Android specific one line patch.
While the PF_KEY interface is deprecated in favour of netlink XFRM (which allows the app to specify an arbitrary truncation length), changing the PF_KEY truncation length from 96 to 128 allows PF_KEY apps such as racoon to work with standards-compliant VPN servers.
--- net/xfrm/Kconfig | 10 ++++++++++ net/xfrm/xfrm_algo.c | 4 ++++ 2 files changed, 14 insertions(+)
net/xfrm/Kconfig +10 -0
@@ -15,6 +15,16 @@ config XFRM_ALGO select XFRM select CRYPTO +config XFRM_HMAC_SHA256_RFC4868 + bool "Strict RFC4868 hmac(sha256) 128-bit truncation" + depends on XFRM_ALGO + default n + ---help--- + Support strict RFC4868 hmac(sha256) 128-bit truncation + (default on Android) instead of the default 96-bit Linux truncation. + + If unsure, say N. + config XFRM_USER tristate "Transformation user configuration interface" depends on INET
net/xfrm/xfrm_algo.c +4 -0
@@ -241,7 +241,11 @@ static struct xfrm_algo_desc aalg_list[] = { .uinfo = { .auth = { +#if IS_ENABLED (CONFIG_XFRM_HMAC_SHA256_RFC4868 ) + .icv_truncbits = 128, +#else .icv_truncbits = 96, +#endif .icv_fullbits = 256, } },
Signature · 1 line
2.19.1.331.ge82ca0e54c-goog
Yes, I realize there's been similar submits in the past, but we're trying to get rid of or upstream android kernel networking divergences...
maybe this approach will be more palatable?
Thanks,
Maciej
net/xfrm/Kconfig config XFRM_ALGO · line 24
Quoted 7 lines · Maciej Żenczykowski
net/xfrm/Kconfig +7
-0+config XFRM_HMAC_SHA256_RFC4868 + bool "Strict RFC4868 hmac(sha256) 128-bit truncation" + depends on XFRM_ALGO + default n + ---help--- + Support strict RFC4868 hmac(sha256) 128-bit truncation + (default on Android) instead of the default 96-bit Linux truncation.
Not sure it's worth mentioning Android here, given that other contributors from other organizations have attempted to change this as well.
net/xfrm/xfrm_algo.c static struct xfrm_algo_desc aalg_list[] = { · line 248
Quoted 7 lines
.uinfo = { .auth = {net/xfrm/xfrm_algo.c +4
-0+#if IS_ENABLED (CONFIG_XFRM_HMAC_SHA256_RFC4868 ) + .icv_truncbits = 128, +#else .icv_truncbits = 96, +#endif
Also, consider adding a Tested: line saying that this allows pf_key_test.py to pass on upstream kernels.
Other than that,
Herbert Xu
maintainernet/xfrm/xfrm_algo.c static struct xfrm_algo_desc aalg_list[] = { · line 248
Quoted 6 lines · Maciej Żenczykowski
net/xfrm/xfrm_algo.c +4
-0+#if IS_ENABLED (CONFIG_XFRM_HMAC_SHA256_RFC4868 ) + .icv_truncbits = 128, +#else .icv_truncbits = 96, +#endif
Nack. We don't want a build-time configuration knob for this. This needs to be decided at run-time.
In fact you can already do this at run-time anyway through the xfrm interface. So please please please just ditch whatever that you're using that's still glued to the long-obsolete (more than a decade) af_key interface and switch it over to xfrm.
Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
I'm afraid it's nothing we're using. It's what people are using. I guess we'll just carry this patch for a few more years.