| Message ID | 46fcb205-989e-4ea7-463d-e72b85db9e71@strongswan.org (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [ipsec] af_key: Reject optional tunnel/BEET mode templates in outbound policies | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
On Fri, May 05, 2023 at 01:36:15PM +0200, Tobias Brunner wrote: > xfrm_state_find() uses `encap_family` of the current template with > the passed local and remote addresses to find a matching state. > If an optional tunnel or BEET mode template is skipped in a mixed-family > scenario, there could be a mismatch causing an out-of-bounds read as > the addresses were not replaced to match the family of the next template. > > While there are theoretical use cases for optional templates in outbound > policies, the only practical one is to skip IPComp states in inbound > policies if uncompressed packets are received that are handled by an > implicitly created IPIP state instead. > > Signed-off-by: Tobias Brunner <tobias@strongswan.org> > --- > net/key/af_key.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Thanks,
On Fri, May 05, 2023 at 01:36:15PM +0200, Tobias Brunner wrote: > xfrm_state_find() uses `encap_family` of the current template with > the passed local and remote addresses to find a matching state. > If an optional tunnel or BEET mode template is skipped in a mixed-family > scenario, there could be a mismatch causing an out-of-bounds read as > the addresses were not replaced to match the family of the next template. > > While there are theoretical use cases for optional templates in outbound > policies, the only practical one is to skip IPComp states in inbound > policies if uncompressed packets are received that are handled by an > implicitly created IPIP state instead. > > Signed-off-by: Tobias Brunner <tobias@strongswan.org> Same corruption with this patch, and please add a 'Fixes' tag here too. Thanks!
diff --git a/net/key/af_key.c b/net/key/af_key.c index a815f5ab4c49..31ab12fd720a 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1940,7 +1940,8 @@ static u32 gen_reqid(struct net *net) } static int -parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) +parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_policy *pol, + struct sadb_x_ipsecrequest *rq) { struct net *net = xp_net(xp); struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr; @@ -1958,9 +1959,12 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) return -EINVAL; t->mode = mode; - if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) + if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) { + if ((mode == XFRM_MODE_TUNNEL || mode == XFRM_MODE_BEET) && + pol->sadb_x_policy_dir == IPSEC_DIR_OUTBOUND) + return -EINVAL; t->optional = 1; - else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) { + } else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) { t->reqid = rq->sadb_x_ipsecrequest_reqid; if (t->reqid > IPSEC_MANUAL_REQID_MAX) t->reqid = 0; @@ -2002,7 +2006,7 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) rq->sadb_x_ipsecrequest_len < sizeof(*rq)) return -EINVAL; - if ((err = parse_ipsecrequest(xp, rq)) < 0) + if ((err = parse_ipsecrequest(xp, pol, rq)) < 0) return err; len -= rq->sadb_x_ipsecrequest_len; rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len);
xfrm_state_find() uses `encap_family` of the current template with the passed local and remote addresses to find a matching state. If an optional tunnel or BEET mode template is skipped in a mixed-family scenario, there could be a mismatch causing an out-of-bounds read as the addresses were not replaced to match the family of the next template. While there are theoretical use cases for optional templates in outbound policies, the only practical one is to skip IPComp states in inbound policies if uncompressed packets are received that are handled by an implicitly created IPIP state instead. Signed-off-by: Tobias Brunner <tobias@strongswan.org> --- net/key/af_key.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)