| Message ID | 5d5bf4d9-5b63-ae0d-2f65-770e911ea7d6@strongswan.org (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [ipsec] xfrm: Reject optional tunnel/BEET mode templates in outbound policies | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
On Fri, May 05, 2023 at 12:16:16PM +0200, Tobias Brunner wrote: > xfrm_state_find() uses `encap_family` of the current template with > the passed local and remote addresses to find a matching state. > If an optional tunnel or BEET mode template is skipped in a mixed-family > scenario, there could be a mismatch causing an out-of-bounds read as > the addresses were not replaced to match the family of the next template. > > While there are theoretical use cases for optional templates in outbound > policies, the only practical one is to skip IPComp states in inbound > policies if uncompressed packets are received that are handled by an > implicitly created IPIP state instead. > > Signed-off-by: Tobias Brunner <tobias@strongswan.org> > --- > net/xfrm/xfrm_user.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) Acked-by: Herbert Xu <herbert@gondor.apana.org.au> However, I think a similar check needs to be added to af_key.c as it too seems to allow optional outbound tunnel-mode templates. Thanks,
On Fri, May 05, 2023 at 12:16:16PM +0200, Tobias Brunner wrote: > xfrm_state_find() uses `encap_family` of the current template with > the passed local and remote addresses to find a matching state. > If an optional tunnel or BEET mode template is skipped in a mixed-family > scenario, there could be a mismatch causing an out-of-bounds read as > the addresses were not replaced to match the family of the next template. > > While there are theoretical use cases for optional templates in outbound > policies, the only practical one is to skip IPComp states in inbound > policies if uncompressed packets are received that are handled by an > implicitly created IPIP state instead. > > Signed-off-by: Tobias Brunner <tobias@strongswan.org> Your patch seems to be corrupt: warning: Patch sent with format=flowed; space at the end of lines might be lost. Applying: af_key: Reject optional tunnel/BEET mode templates in outbound policies error: corrupt patch at line 18 Also, please add a 'Fixes' tag, so that it can be backported. Thanks!
On 08.05.23 07:59, Steffen Klassert wrote: > On Fri, May 05, 2023 at 12:16:16PM +0200, Tobias Brunner wrote: >> xfrm_state_find() uses `encap_family` of the current template with >> the passed local and remote addresses to find a matching state. >> If an optional tunnel or BEET mode template is skipped in a mixed-family >> scenario, there could be a mismatch causing an out-of-bounds read as >> the addresses were not replaced to match the family of the next template. >> >> While there are theoretical use cases for optional templates in outbound >> policies, the only practical one is to skip IPComp states in inbound >> policies if uncompressed packets are received that are handled by an >> implicitly created IPIP state instead. >> >> Signed-off-by: Tobias Brunner <tobias@strongswan.org> > > Your patch seems to be corrupt: > > warning: Patch sent with format=flowed; space at the end of lines might be lost. > Applying: af_key: Reject optional tunnel/BEET mode templates in outbound policies > error: corrupt patch at line 18 Sorry about that, I'll resend. > Also, please add a 'Fixes' tag, so that it can be backported. What should the target commit be? I saw you used 1da177e4c3f4 ("Linux-2.6.12-rc2") in your fix, but maybe the more recent 8444cf712c5f ("xfrm: Allow different selector family in temporary state") would fit better as that changed `family` to `encap_family` in `xfrm_state_find()`? (I guess it doesn't matter in practice as 2.6.36 is way older than any LTS kernel this will get backported to.) Regards, Tobias
On Mon, May 08, 2023 at 11:03:36AM +0200, Tobias Brunner wrote: > On 08.05.23 07:59, Steffen Klassert wrote: > > On Fri, May 05, 2023 at 12:16:16PM +0200, Tobias Brunner wrote: > >> xfrm_state_find() uses `encap_family` of the current template with > >> the passed local and remote addresses to find a matching state. > >> If an optional tunnel or BEET mode template is skipped in a mixed-family > >> scenario, there could be a mismatch causing an out-of-bounds read as > >> the addresses were not replaced to match the family of the next template. > >> > >> While there are theoretical use cases for optional templates in outbound > >> policies, the only practical one is to skip IPComp states in inbound > >> policies if uncompressed packets are received that are handled by an > >> implicitly created IPIP state instead. > >> > >> Signed-off-by: Tobias Brunner <tobias@strongswan.org> > > > > Your patch seems to be corrupt: > > > > warning: Patch sent with format=flowed; space at the end of lines might be lost. > > Applying: af_key: Reject optional tunnel/BEET mode templates in outbound policies > > error: corrupt patch at line 18 > > Sorry about that, I'll resend. > > > Also, please add a 'Fixes' tag, so that it can be backported. > > What should the target commit be? I saw you used 1da177e4c3f4 > ("Linux-2.6.12-rc2") in your fix, but maybe the more recent 8444cf712c5f > ("xfrm: Allow different selector family in temporary state") would fit > better as that changed `family` to `encap_family` in > `xfrm_state_find()`? (I guess it doesn't matter in practice as 2.6.36 > is way older than any LTS kernel this will get backported to.) I think it was broken, even before 8444cf712c5f "xfrm: Allow different selector family in temporary state"), so I used 1da177e4c3f4. But as you said, it doesn't really matter. Both commits are much older than any currently active LTS kernel.
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index af8fbcbfbe69..6794b9dea27a 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1768,7 +1768,7 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, } static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family, - struct netlink_ext_ack *extack) + int dir, struct netlink_ext_ack *extack) { u16 prev_family; int i; @@ -1794,6 +1794,10 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family, switch (ut[i].mode) { case XFRM_MODE_TUNNEL: case XFRM_MODE_BEET: + if (ut[i].optional && dir == XFRM_POLICY_OUT) { + NL_SET_ERR_MSG(extack, "Mode in optional template not allowed in outbound policy"); + return -EINVAL; + } break; default: if (ut[i].family != prev_family) { @@ -1831,7 +1835,7 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family, } static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs, - struct netlink_ext_ack *extack) + int dir, struct netlink_ext_ack *extack) { struct nlattr *rt = attrs[XFRMA_TMPL]; @@ -1842,7 +1846,7 @@ static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs, int nr = nla_len(rt) / sizeof(*utmpl); int err; - err = validate_tmpl(nr, utmpl, pol->family, extack); + err = validate_tmpl(nr, utmpl, pol->family, dir, extack); if (err) return err; @@ -1919,7 +1923,7 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, if (err) goto error; - if (!(err = copy_from_user_tmpl(xp, attrs, extack))) + if (!(err = copy_from_user_tmpl(xp, attrs, p->dir, extack))) err = copy_from_user_sec_ctx(xp, attrs); if (err) goto error; @@ -3498,7 +3502,7 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt, return NULL; nr = ((len - sizeof(*p)) / sizeof(*ut)); - if (validate_tmpl(nr, ut, p->sel.family, NULL)) + if (validate_tmpl(nr, ut, p->sel.family, p->dir, NULL)) return NULL; if (p->dir > XFRM_POLICY_OUT)
xfrm_state_find() uses `encap_family` of the current template with the passed local and remote addresses to find a matching state. If an optional tunnel or BEET mode template is skipped in a mixed-family scenario, there could be a mismatch causing an out-of-bounds read as the addresses were not replaced to match the family of the next template. While there are theoretical use cases for optional templates in outbound policies, the only practical one is to skip IPComp states in inbound policies if uncompressed packets are received that are handled by an implicitly created IPIP state instead. Signed-off-by: Tobias Brunner <tobias@strongswan.org> --- net/xfrm/xfrm_user.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)