* [PATCHv3 net-next 2/3] xfrm: export verify_userspi_info for pkfey and netlink interface
2013-12-16 10:47 [PATCHv3 net-next 0/3] IPComp fixes Fan Du
2013-12-16 10:47 ` [PATCHv3 net-next 1/3] xfrm: check user specified spi for IPComp Fan Du
@ 2013-12-16 10:47 ` Fan Du
2013-12-16 10:47 ` [PATCHv3 net-next 3/3] xfrm: Add file to document IPsec corner case Fan Du
2013-12-17 11:37 ` [PATCHv3 net-next 0/3] IPComp fixes Steffen Klassert
3 siblings, 0 replies; 5+ messages in thread
From: Fan Du @ 2013-12-16 10:47 UTC (permalink / raw)
To: steffen.klassert; +Cc: davem, netdev
In order to check against valid IPcomp spi range, export verify_userspi_info
for both pfkey and netlink interface.
Signed-off-by: Fan Du <fan.du@windriver.com>
---
include/net/xfrm.h | 1 +
net/key/af_key.c | 6 ++++++
net/xfrm/xfrm_state.c | 24 ++++++++++++++++++++++++
net/xfrm/xfrm_user.c | 25 +------------------------
4 files changed, 32 insertions(+), 24 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 6b82fdf..369fa99 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1564,6 +1564,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
u32 id, int delete, int *err);
int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
u32 xfrm_get_acqseq(void);
+int verify_spi_info(u8 proto, u32 min, u32 max);
int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
u8 mode, u32 reqid, u8 proto,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 545f047..6c8d9ff 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1340,6 +1340,12 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
max_spi = range->sadb_spirange_max;
}
+ err = verify_spi_info(x->id.proto, min_spi, max_spi);
+ if (err) {
+ xfrm_state_put(x);
+ return err;
+ }
+
err = xfrm_alloc_spi(x, min_spi, max_spi);
resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 68c2f35..6bf2a84 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1496,6 +1496,30 @@ u32 xfrm_get_acqseq(void)
}
EXPORT_SYMBOL(xfrm_get_acqseq);
+int verify_spi_info(u8 proto, u32 min, u32 max)
+{
+ switch (proto) {
+ case IPPROTO_AH:
+ case IPPROTO_ESP:
+ break;
+
+ case IPPROTO_COMP:
+ /* IPCOMP spi is 16-bits. */
+ if (max >= 0x10000)
+ return -EINVAL;
+ break;
+
+ default:
+ return -EINVAL;
+ }
+
+ if (min > max)
+ return -EINVAL;
+
+ return 0;
+}
+EXPORT_SYMBOL(verify_spi_info);
+
int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
{
struct net *net = xs_net(x);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 8543b1b..f837983 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1076,29 +1076,6 @@ out_noput:
return err;
}
-static int verify_userspi_info(struct xfrm_userspi_info *p)
-{
- switch (p->info.id.proto) {
- case IPPROTO_AH:
- case IPPROTO_ESP:
- break;
-
- case IPPROTO_COMP:
- /* IPCOMP spi is 16-bits. */
- if (p->max >= 0x10000)
- return -EINVAL;
- break;
-
- default:
- return -EINVAL;
- }
-
- if (p->min > p->max)
- return -EINVAL;
-
- return 0;
-}
-
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
struct nlattr **attrs)
{
@@ -1113,7 +1090,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
struct xfrm_mark m;
p = nlmsg_data(nlh);
- err = verify_userspi_info(p);
+ err = verify_spi_info(p->info.id.proto, p->min, p->max);
if (err)
goto out_noput;
--
1.7.9.5
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCHv3 net-next 3/3] xfrm: Add file to document IPsec corner case
2013-12-16 10:47 [PATCHv3 net-next 0/3] IPComp fixes Fan Du
2013-12-16 10:47 ` [PATCHv3 net-next 1/3] xfrm: check user specified spi for IPComp Fan Du
2013-12-16 10:47 ` [PATCHv3 net-next 2/3] xfrm: export verify_userspi_info for pkfey and netlink interface Fan Du
@ 2013-12-16 10:47 ` Fan Du
2013-12-17 11:37 ` [PATCHv3 net-next 0/3] IPComp fixes Steffen Klassert
3 siblings, 0 replies; 5+ messages in thread
From: Fan Du @ 2013-12-16 10:47 UTC (permalink / raw)
To: steffen.klassert; +Cc: davem, netdev
Create Documentation/networking/ipsec.txt to document IPsec
corner issues and other info, which will be useful when user
deploying IPsec.
Signed-off-by: Fan Du <fan.du@windriver.com>
---
Documentation/networking/ipsec.txt | 38 ++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
create mode 100644 Documentation/networking/ipsec.txt
diff --git a/Documentation/networking/ipsec.txt b/Documentation/networking/ipsec.txt
new file mode 100644
index 0000000..8dbc08b
--- /dev/null
+++ b/Documentation/networking/ipsec.txt
@@ -0,0 +1,38 @@
+
+Here documents known IPsec corner cases which need to be keep in mind when
+deploy various IPsec configuration in real world production environment.
+
+1. IPcomp: Small IP packet won't get compressed at sender, and failed on
+ policy check on receiver.
+
+Quote from RFC3173:
+2.2. Non-Expansion Policy
+
+ If the total size of a compressed payload and the IPComp header, as
+ defined in section 3, is not smaller than the size of the original
+ payload, the IP datagram MUST be sent in the original non-compressed
+ form. To clarify: If an IP datagram is sent non-compressed, no
+
+ IPComp header is added to the datagram. This policy ensures saving
+ the decompression processing cycles and avoiding incurring IP
+ datagram fragmentation when the expanded datagram is larger than the
+ MTU.
+
+ Small IP datagrams are likely to expand as a result of compression.
+ Therefore, a numeric threshold should be applied before compression,
+ where IP datagrams of size smaller than the threshold are sent in the
+ original form without attempting compression. The numeric threshold
+ is implementation dependent.
+
+Current IPComp implementation is indeed by the book, while as in practice
+when sending non-compressed packet to the peer(whether or not packet len
+is smaller than the threshold or the compressed len is large than original
+packet len), the packet is dropped when checking the policy as this packet
+matches the selector but not coming from any XFRM layer, i.e., with no
+security path. Such naked packet will not eventually make it to upper layer.
+The result is much more wired to the user when ping peer with different
+payload length.
+
+One workaround is try to set "level use" for each policy if user observed
+above scenario. The consequence of doing so is small packet(uncompressed)
+will skip policy checking on receiver side.
--
1.7.9.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCHv3 net-next 0/3] IPComp fixes
2013-12-16 10:47 [PATCHv3 net-next 0/3] IPComp fixes Fan Du
` (2 preceding siblings ...)
2013-12-16 10:47 ` [PATCHv3 net-next 3/3] xfrm: Add file to document IPsec corner case Fan Du
@ 2013-12-17 11:37 ` Steffen Klassert
3 siblings, 0 replies; 5+ messages in thread
From: Steffen Klassert @ 2013-12-17 11:37 UTC (permalink / raw)
To: Fan Du; +Cc: davem, netdev
On Mon, Dec 16, 2013 at 06:47:47PM +0800, Fan Du wrote:
> Hi,
>
> This patchset includes bug fix focusing on IPComp mainly, which addresses
> IPComp Compression Parameter Index(CPI, 16bits of 32bits SPI value) problem.
>
> And other issue is the compression part, undesirable packet will not be
> compressed, and then send into wire, this packet will be dropped by policy
> checking in the receiver side.
>
> v2:
> Patch1: Clean up align issue from v1.
> Patch2: Introduce verify_userspi_info for pkfey and netlink interface
> to share code.
> Patch3: Add Documentation/networking/ipsec.txt to document known issues.
>
> v3:
> Patch2: Fix while space error.
> Patch3: Del empty line
>
> Fan Du (3):
> xfrm: check user specified spi for IPComp
> xfrm: export verify_userspi_info for pkfey and netlink interface
> xfrm: Add file to document IPsec corner case
>
All applied to ipsec-next, thanks Fan!
^ permalink raw reply [flat|nested] 5+ messages in thread