* [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization
@ 2011-04-26 5:39 Steffen Klassert
2011-04-26 5:40 ` [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization Steffen Klassert
` (3 more replies)
0 siblings, 4 replies; 13+ messages in thread
From: Steffen Klassert @ 2011-04-26 5:39 UTC (permalink / raw)
To: David Miller, Herbert Xu; +Cc: netdev
On replay initialization, we compute the size of the replay
buffer to see if the replay window fits into the buffer.
This computation lacks a mutliplication by 8 because we need
the size in bit, not in byte. So we might return an error
even though the replay window would fit into the buffer.
This patch fixes this issue.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_replay.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index f218385..e8a7814 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -532,7 +532,7 @@ int xfrm_init_replay(struct xfrm_state *x)
if (replay_esn) {
if (replay_esn->replay_window >
- replay_esn->bmp_len * sizeof(__u32))
+ replay_esn->bmp_len * sizeof(__u32) * 8)
return -EINVAL;
if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
--
1.7.0.4
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization
2011-04-26 5:39 [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Steffen Klassert
@ 2011-04-26 5:40 ` Steffen Klassert
2011-04-26 5:41 ` Herbert Xu
2011-04-26 5:41 ` [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Herbert Xu
` (2 subsequent siblings)
3 siblings, 1 reply; 13+ messages in thread
From: Steffen Klassert @ 2011-04-26 5:40 UTC (permalink / raw)
To: David Miller, Herbert Xu; +Cc: netdev
When we use IPsec extended sequence numbers, we may overwrite
the last scatterlist of the associated data by the scatterlist
for the skb. This patch fixes this by placing the scatterlist
for the skb right behind the last scatterlist of the associated
data. esp4 does it already like that.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/ipv6/esp6.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 5aa8ec8..59dccfb 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -371,7 +371,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
iv = esp_tmp_iv(aead, tmp, seqhilen);
req = esp_tmp_req(aead, iv);
asg = esp_req_sg(aead, req);
- sg = asg + 1;
+ sg = asg + sglists;
skb->ip_summed = CHECKSUM_NONE;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization
2011-04-26 5:40 ` [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization Steffen Klassert
@ 2011-04-26 5:41 ` Herbert Xu
2011-04-26 19:47 ` David Miller
0 siblings, 1 reply; 13+ messages in thread
From: Herbert Xu @ 2011-04-26 5:41 UTC (permalink / raw)
To: Steffen Klassert; +Cc: David Miller, netdev
On Tue, Apr 26, 2011 at 07:40:23AM +0200, Steffen Klassert wrote:
> When we use IPsec extended sequence numbers, we may overwrite
> the last scatterlist of the associated data by the scatterlist
> for the skb. This patch fixes this by placing the scatterlist
> for the skb right behind the last scatterlist of the associated
> data. esp4 does it already like that.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization
2011-04-26 5:41 ` Herbert Xu
@ 2011-04-26 19:47 ` David Miller
0 siblings, 0 replies; 13+ messages in thread
From: David Miller @ 2011-04-26 19:47 UTC (permalink / raw)
To: herbert; +Cc: steffen.klassert, netdev
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 26 Apr 2011 15:41:58 +1000
> On Tue, Apr 26, 2011 at 07:40:23AM +0200, Steffen Klassert wrote:
>> When we use IPsec extended sequence numbers, we may overwrite
>> the last scatterlist of the associated data by the scatterlist
>> for the skb. This patch fixes this by placing the scatterlist
>> for the skb right behind the last scatterlist of the associated
>> data. esp4 does it already like that.
>>
>> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization
2011-04-26 5:39 [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Steffen Klassert
2011-04-26 5:40 ` [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization Steffen Klassert
@ 2011-04-26 5:41 ` Herbert Xu
2011-04-26 19:47 ` David Miller
2011-04-26 5:41 ` [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted Steffen Klassert
2011-04-26 5:42 ` [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows Steffen Klassert
3 siblings, 1 reply; 13+ messages in thread
From: Herbert Xu @ 2011-04-26 5:41 UTC (permalink / raw)
To: Steffen Klassert; +Cc: David Miller, netdev
On Tue, Apr 26, 2011 at 07:39:24AM +0200, Steffen Klassert wrote:
> On replay initialization, we compute the size of the replay
> buffer to see if the replay window fits into the buffer.
> This computation lacks a mutliplication by 8 because we need
> the size in bit, not in byte. So we might return an error
> even though the replay window would fit into the buffer.
> This patch fixes this issue.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization
2011-04-26 5:41 ` [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Herbert Xu
@ 2011-04-26 19:47 ` David Miller
0 siblings, 0 replies; 13+ messages in thread
From: David Miller @ 2011-04-26 19:47 UTC (permalink / raw)
To: herbert; +Cc: steffen.klassert, netdev
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 26 Apr 2011 15:41:07 +1000
> On Tue, Apr 26, 2011 at 07:39:24AM +0200, Steffen Klassert wrote:
>> On replay initialization, we compute the size of the replay
>> buffer to see if the replay window fits into the buffer.
>> This computation lacks a mutliplication by 8 because we need
>> the size in bit, not in byte. So we might return an error
>> even though the replay window would fit into the buffer.
>> This patch fixes this issue.
>>
>> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted
2011-04-26 5:39 [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Steffen Klassert
2011-04-26 5:40 ` [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization Steffen Klassert
2011-04-26 5:41 ` [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Herbert Xu
@ 2011-04-26 5:41 ` Steffen Klassert
2011-04-26 5:43 ` Herbert Xu
2011-04-26 5:42 ` [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows Steffen Klassert
3 siblings, 1 reply; 13+ messages in thread
From: Steffen Klassert @ 2011-04-26 5:41 UTC (permalink / raw)
To: David Miller, Herbert Xu; +Cc: netdev
IPsec extended sequence numbers can be used only with the new
anti-replay window implementation. So check if the new implementation
is used if an esn state is inserted and return an error if it is not.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_user.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5d1d60d..c658cb3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -124,6 +124,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
{
struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
+ if ((p->flags & XFRM_STATE_ESN) && !rt)
+ return -EINVAL;
+
if (!rt)
return 0;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted
2011-04-26 5:41 ` [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted Steffen Klassert
@ 2011-04-26 5:43 ` Herbert Xu
2011-04-26 19:47 ` David Miller
0 siblings, 1 reply; 13+ messages in thread
From: Herbert Xu @ 2011-04-26 5:43 UTC (permalink / raw)
To: Steffen Klassert; +Cc: David Miller, netdev
On Tue, Apr 26, 2011 at 07:41:21AM +0200, Steffen Klassert wrote:
> IPsec extended sequence numbers can be used only with the new
> anti-replay window implementation. So check if the new implementation
> is used if an esn state is inserted and return an error if it is not.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted
2011-04-26 5:43 ` Herbert Xu
@ 2011-04-26 19:47 ` David Miller
0 siblings, 0 replies; 13+ messages in thread
From: David Miller @ 2011-04-26 19:47 UTC (permalink / raw)
To: herbert; +Cc: steffen.klassert, netdev
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 26 Apr 2011 15:43:04 +1000
> On Tue, Apr 26, 2011 at 07:41:21AM +0200, Steffen Klassert wrote:
>> IPsec extended sequence numbers can be used only with the new
>> anti-replay window implementation. So check if the new implementation
>> is used if an esn state is inserted and return an error if it is not.
>>
>> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows
2011-04-26 5:39 [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Steffen Klassert
` (2 preceding siblings ...)
2011-04-26 5:41 ` [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted Steffen Klassert
@ 2011-04-26 5:42 ` Steffen Klassert
2011-04-26 6:01 ` Herbert Xu
2011-04-26 10:58 ` Steffen Klassert
3 siblings, 2 replies; 13+ messages in thread
From: Steffen Klassert @ 2011-04-26 5:42 UTC (permalink / raw)
To: David Miller, Herbert Xu; +Cc: netdev
The check if the replay window is contained within one subspace or
spans over two subspaces causes an unwanted integer underrun on
zero sized replay windows when we subtract minus one. We fix this by
changeing this check to avoid the subtraction.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_replay.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index e8a7814..19f94bb 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -32,7 +32,7 @@ u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
seq_hi = replay_esn->seq_hi;
bottom = replay_esn->seq - replay_esn->replay_window + 1;
- if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
+ if (likely(replay_esn->seq > replay_esn->replay_window)) {
/* A. same subspace */
if (unlikely(seq < bottom))
seq_hi++;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows
2011-04-26 5:42 ` [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows Steffen Klassert
@ 2011-04-26 6:01 ` Herbert Xu
2011-04-26 10:58 ` Steffen Klassert
1 sibling, 0 replies; 13+ messages in thread
From: Herbert Xu @ 2011-04-26 6:01 UTC (permalink / raw)
To: Steffen Klassert; +Cc: David Miller, netdev
On Tue, Apr 26, 2011 at 07:42:32AM +0200, Steffen Klassert wrote:
> The check if the replay window is contained within one subspace or
> spans over two subspaces causes an unwanted integer underrun on
> zero sized replay windows when we subtract minus one. We fix this by
> changeing this check to avoid the subtraction.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows
2011-04-26 5:42 ` [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows Steffen Klassert
2011-04-26 6:01 ` Herbert Xu
@ 2011-04-26 10:58 ` Steffen Klassert
2011-04-26 19:48 ` David Miller
1 sibling, 1 reply; 13+ messages in thread
From: Steffen Klassert @ 2011-04-26 10:58 UTC (permalink / raw)
To: David Miller, Herbert Xu; +Cc: netdev
On Tue, Apr 26, 2011 at 07:42:32AM +0200, Steffen Klassert wrote:
> The check if the replay window is contained within one subspace or
> spans over two subspaces causes an unwanted integer underrun on
> zero sized replay windows when we subtract minus one. We fix this by
> changeing this check to avoid the subtraction.
>
Don't apply this one, it does not fix the issue completely.
I'll send a better one, sorry.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows
2011-04-26 10:58 ` Steffen Klassert
@ 2011-04-26 19:48 ` David Miller
0 siblings, 0 replies; 13+ messages in thread
From: David Miller @ 2011-04-26 19:48 UTC (permalink / raw)
To: steffen.klassert; +Cc: herbert, netdev
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Tue, 26 Apr 2011 12:58:40 +0200
> On Tue, Apr 26, 2011 at 07:42:32AM +0200, Steffen Klassert wrote:
>> The check if the replay window is contained within one subspace or
>> spans over two subspaces causes an unwanted integer underrun on
>> zero sized replay windows when we subtract minus one. We fix this by
>> changeing this check to avoid the subtraction.
>>
>
> Don't apply this one, it does not fix the issue completely.
> I'll send a better one, sorry.
Ok.
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2011-04-26 19:48 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-04-26 5:39 [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Steffen Klassert
2011-04-26 5:40 ` [PATCH net-2.6 2/4] esp6: Fix scatterlist initialization Steffen Klassert
2011-04-26 5:41 ` Herbert Xu
2011-04-26 19:47 ` David Miller
2011-04-26 5:41 ` [PATCH net-2.6 1/4] xfrm: Fix replay window size calculation on initialization Herbert Xu
2011-04-26 19:47 ` David Miller
2011-04-26 5:41 ` [PATCH net-2.6 3/4] xfrm: Check for the new replay implementation if an esn state is inserted Steffen Klassert
2011-04-26 5:43 ` Herbert Xu
2011-04-26 19:47 ` David Miller
2011-04-26 5:42 ` [PATCH net-2.6 4/4] xfrm: Fix integer underrun on zero sized replay windows Steffen Klassert
2011-04-26 6:01 ` Herbert Xu
2011-04-26 10:58 ` Steffen Klassert
2011-04-26 19:48 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).