linux.git/net/ipv4/esp4.c, branch v5.11

esp: avoid unneeded kmap_atomic call

2021-01-12T02:20:09+00:00

esp(6)_output_head uses skb_page_frag_refill to allocate a buffer for
the esp trailer.

It accesses the page with kmap_atomic to handle highmem. But
skb_page_frag_refill can return compound pages, of which
kmap_atomic only maps the first underlying page.

skb_page_frag_refill does not return highmem, because flag
__GFP_HIGHMEM is not set. ESP uses it in the same manner as TCP.
That also does not call kmap_atomic, but directly uses page_address,
in skb_copy_to_page_nocache. Do the same for ESP.

This issue has become easier to trigger with recent kmap local
debugging feature CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Willem de Bruijn 
Acked-by: Steffen Klassert 
Signed-off-by: Jakub Kicinski

ESP: Export esp_output_fill_trailer function

2020-02-19T12:52:32+00:00

The esp fill trailer method is identical for both
IPv6 and IPv4.

Share the implementation for esp6 and esp to avoid
code duplication in addition it could be also used
at various drivers code.

Signed-off-by: Raed Salem 
Reviewed-by: Boris Pismenny 
Reviewed-by: Saeed Mahameed 
Signed-off-by: Steffen Klassert

xfrm: add espintcp (RFC 8229)

2019-12-09T08:59:07+00:00

TCP encapsulation of IKE and IPsec messages (RFC 8229) is implemented
as a TCP ULP, overriding in particular the sendmsg and recvmsg
operations. A Stream Parser is used to extract messages out of the TCP
stream using the first 2 bytes as length marker. Received IKE messages
are put on "ike_queue", waiting to be dequeued by the custom recvmsg
implementation. Received ESP messages are sent to XFRM, like with UDP
encapsulation.

Some of this code is taken from the original submission by Herbert
Xu. Currently, only IPv4 is supported, like for UDP encapsulation.

Co-developed-by: Herbert Xu 
Signed-off-by: Herbert Xu 
Signed-off-by: Sabrina Dubroca 
Acked-by: David S. Miller 
Signed-off-by: Steffen Klassert

esp4: split esp_output_udp_encap and introduce esp_output_encap

2019-12-09T08:59:07+00:00

Co-developed-by: Herbert Xu 
Signed-off-by: Herbert Xu 
Signed-off-by: Sabrina Dubroca 
Acked-by: David S. Miller 
Signed-off-by: Steffen Klassert

esp4: prepare esp_input_done2 for non-UDP encapsulation

2019-12-09T08:59:07+00:00

For espintcp encapsulation, we will need to get the source port from the
TCP header instead of UDP. Introduce a variable to hold the port.

Co-developed-by: Herbert Xu 
Signed-off-by: Herbert Xu 
Signed-off-by: Sabrina Dubroca 
Acked-by: David S. Miller 
Signed-off-by: Steffen Klassert

xfrm: remove get_mtu indirection from xfrm_type

2019-07-01T04:16:40+00:00

esp4_get_mtu and esp6_get_mtu are exactly the same, the only difference
is a single sizeof() (ipv4 vs. ipv6 header).

Merge both into xfrm_state_mtu() and remove the indirection.

Signed-off-by: Florian Westphal 
Signed-off-by: Steffen Klassert

xfrm: remove type and offload_type map from xfrm_state_afinfo

2019-06-06T06:34:50+00:00

Only a handful of xfrm_types exist, no need to have 512 pointers for them.

Reduces size of afinfo struct from 4k to 120 bytes on 64bit platforms.

Also, the unregister function doesn't need to return an error, no single
caller does anything useful with it.

Just place a WARN_ON() where needed instead.

Signed-off-by: Florian Westphal 
Signed-off-by: Steffen Klassert

treewide: Add SPDX license identifier for more missed files

2019-05-21T08:50:45+00:00

Add SPDX license identifiers to all files which:

 - Have no license information of any form

 - Have MODULE_LICENCE("GPL*") inside which was used in the initial
   scan/conversion to ignore the file

These files fall under the project license, GPL v2 only. The resulting SPDX
license identifier is:

  GPL-2.0-only

Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

esp4: add length check for UDP encapsulation

2019-03-26T07:39:30+00:00

esp_output_udp_encap can produce a length that doesn't fit in the 16
bits of a UDP header's length field. In that case, we'll send a
fragmented packet whose length is larger than IP_MAX_MTU (resulting in
"Oversized IP packet" warnings on receive) and with a bogus UDP
length.

To prevent this, add a length check to esp_output_udp_encap and return
 -EMSGSIZE on failure.

This seems to be older than git history.

Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert

esp: Skip TX bytes accounting when sending from a request socket

2019-01-28T10:20:58+00:00

On ESP output, sk_wmem_alloc is incremented for the added padding if a
socket is associated to the skb. When replying with TCP SYNACKs over
IPsec, the associated sk is a casted request socket, only. Increasing
sk_wmem_alloc on a request socket results in a write at an arbitrary
struct offset. In the best case, this produces the following WARNING:

WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4]
refcount_t: addition on 0; use-after-free.
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2
Hardware name: Marvell Armada 380/385 (Device Tree)
[...]
[] (esp_output_head [esp4]) from [] (esp_output+0xb8/0x180 [esp4])
[] (esp_output [esp4]) from [] (xfrm_output_resume+0x558/0x664)
[] (xfrm_output_resume) from [] (xfrm4_output+0x44/0xc4)
[] (xfrm4_output) from [] (tcp_v4_send_synack+0xa8/0xe8)
[] (tcp_v4_send_synack) from [] (tcp_conn_request+0x7f4/0x948)
[] (tcp_conn_request) from [] (tcp_rcv_state_process+0x2a0/0xe64)
[] (tcp_rcv_state_process) from [] (tcp_v4_do_rcv+0xf0/0x1f4)
[] (tcp_v4_do_rcv) from [] (tcp_v4_rcv+0xdb8/0xe20)
[] (tcp_v4_rcv) from [] (ip_protocol_deliver_rcu+0x2c/0x2dc)
[] (ip_protocol_deliver_rcu) from [] (ip_local_deliver_finish+0x48/0x54)
[] (ip_local_deliver_finish) from [] (ip_local_deliver+0x54/0xec)
[] (ip_local_deliver) from [] (ip_rcv+0x48/0xb8)
[] (ip_rcv) from [] (__netif_receive_skb_one_core+0x50/0x6c)
[...]

The issue triggers only when not using TCP syncookies, as for syncookies
no socket is associated.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Martin Willi 
Signed-off-by: Steffen Klassert