linux-stable.git/net/ipv6/esp6.c, branch linux-5.9.y

xfrm: esp6: fix the location of the transport header with encapsulation

2020-07-28T05:57:23+00:00

commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset
computation") changed esp6_input_done2 to correctly find the size of
the IPv6 header that precedes the TCP/UDP encapsulation header, but
didn't adjust the final call to skb_set_transport_header, which I
assumed was correct in using skb_network_header_len.

Xiumei Mu reported that when we create xfrm states that include port
numbers in the selector, traffic from the user sockets is dropped. It
turns out that we get a state mismatch in __xfrm_policy_check, because
we end up trying to compare the encapsulation header's ports with the
selector that's based on user traffic ports.

Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP")
Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp")
Reported-by: Xiumei Mu 
Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert

xfrm: esp6: fix encapsulation header offset computation

2020-07-07T06:19:46+00:00

In commit 0146dca70b87, I incorrectly adapted the code that computes
the location of the UDP or TCP encapsulation header from IPv4 to
IPv6. In esp6_input_done2, skb->transport_header points to the ESP
header, so by adding skb_network_header_len, uh and th will point to
the ESP header, not the encapsulation header that's in front of it.

Since the TCP header's size can change with options, we have to start
from the IPv6 header and walk past possible extensions.

Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP")
Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp")
Reported-by: Tobias Brunner 
Tested-by: Tobias Brunner 
Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert

xfrm: add IPv6 support for espintcp

2020-04-28T09:28:36+00:00

This extends espintcp to support IPv6, building on the existing code
and the new UDPv6 encapsulation support. Most of the code is either
reused directly (stream parser, ULP) or very similar to the IPv4
variant (net/ipv6/esp6.c changes).

The separation of config options for IPv4 and IPv6 espintcp requires a
bit of Kconfig gymnastics to enable the core code.

Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert

xfrm: add support for UDPv6 encapsulation of ESP

2020-04-28T09:28:36+00:00

This patch adds support for encapsulation of ESP over UDPv6. The code
is very similar to the IPv4 encapsulation implementation, and allows
to easily add espintcp on IPv6 as a follow-up.

Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert

ESP: Export esp_output_fill_trailer function

2020-02-19T12:52:32+00:00

The esp fill trailer method is identical for both
IPv6 and IPv4.

Share the implementation for esp6 and esp to avoid
code duplication in addition it could be also used
at various drivers code.

Signed-off-by: Raed Salem 
Reviewed-by: Boris Pismenny 
Reviewed-by: Saeed Mahameed 
Signed-off-by: Steffen Klassert

xfrm: remove get_mtu indirection from xfrm_type

2019-07-01T04:16:40+00:00

esp4_get_mtu and esp6_get_mtu are exactly the same, the only difference
is a single sizeof() (ipv4 vs. ipv6 header).

Merge both into xfrm_state_mtu() and remove the indirection.

Signed-off-by: Florian Westphal 
Signed-off-by: Steffen Klassert

xfrm: remove type and offload_type map from xfrm_state_afinfo

2019-06-06T06:34:50+00:00

Only a handful of xfrm_types exist, no need to have 512 pointers for them.

Reduces size of afinfo struct from 4k to 120 bytes on 64bit platforms.

Also, the unregister function doesn't need to return an error, no single
caller does anything useful with it.

Just place a WARN_ON() where needed instead.

Signed-off-by: Florian Westphal 
Signed-off-by: Steffen Klassert

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13

2019-05-21T09:28:45+00:00

Based on 2 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details you
  should have received a copy of the gnu general public license along
  with this program if not see http www gnu org licenses

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details [based]
  [from] [clk] [highbank] [c] you should have received a copy of the
  gnu general public license along with this program if not see http
  www gnu org licenses

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 355 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Kate Stewart 
Reviewed-by: Jilayne Lovejoy 
Reviewed-by: Steve Winslow 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190519154041.837383322@linutronix.de
Signed-off-by: Greg Kroah-Hartman

esp: Skip TX bytes accounting when sending from a request socket

2019-01-28T10:20:58+00:00

On ESP output, sk_wmem_alloc is incremented for the added padding if a
socket is associated to the skb. When replying with TCP SYNACKs over
IPsec, the associated sk is a casted request socket, only. Increasing
sk_wmem_alloc on a request socket results in a write at an arbitrary
struct offset. In the best case, this produces the following WARNING:

WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4]
refcount_t: addition on 0; use-after-free.
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2
Hardware name: Marvell Armada 380/385 (Device Tree)
[...]
[] (esp_output_head [esp4]) from [] (esp_output+0xb8/0x180 [esp4])
[] (esp_output [esp4]) from [] (xfrm_output_resume+0x558/0x664)
[] (xfrm_output_resume) from [] (xfrm4_output+0x44/0xc4)
[] (xfrm4_output) from [] (tcp_v4_send_synack+0xa8/0xe8)
[] (tcp_v4_send_synack) from [] (tcp_conn_request+0x7f4/0x948)
[] (tcp_conn_request) from [] (tcp_rcv_state_process+0x2a0/0xe64)
[] (tcp_rcv_state_process) from [] (tcp_v4_do_rcv+0xf0/0x1f4)
[] (tcp_v4_do_rcv) from [] (tcp_v4_rcv+0xdb8/0xe20)
[] (tcp_v4_rcv) from [] (ip_protocol_deliver_rcu+0x2c/0x2dc)
[] (ip_protocol_deliver_rcu) from [] (ip_local_deliver_finish+0x48/0x54)
[] (ip_local_deliver_finish) from [] (ip_local_deliver+0x54/0xec)
[] (ip_local_deliver) from [] (ip_rcv+0x48/0xb8)
[] (ip_rcv) from [] (__netif_receive_skb_one_core+0x50/0x6c)
[...]

The issue triggers only when not using TCP syncookies, as for syncookies
no socket is associated.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Martin Willi 
Signed-off-by: Steffen Klassert

net: use skb_sec_path helper in more places

2018-12-19T19:21:37+00:00

skb_sec_path gains 'const' qualifier to avoid
xt_policy.c: 'skb_sec_path' discards 'const' qualifier from pointer target type

same reasoning as previous conversions: Won't need to touch these
spots anymore when skb->sp is removed.

Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller