Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

[Joakim Koskela]

Hi all, 

I'm running a system where there might be multiple simultenously
active ipsec states between two hosts (ipv6, but guess it applies to
v4 as well) where the outer ip is the same for all states, but the
inner differ (using beet mode).

The problem is that after establishing these states, it seems that the
one associated with outgoing traffic is selected solely by the outer
address (the first state matching the outer ip-pairs is used), which
usually results in the wrong spi and the packet being dropped at the
receiver.

I've circumvented the problem by modifying the state selection
algorithm in xfrm_state_find() [xfrm_state.c] to prefer, if possible,
states which also match by the inner addresses. Is this really a
problem of the selection algorithm, or might I be doing something 
wrong elsewhere?

Here's the changes I've done to make it work for me.  As said, it
prefers states with matching inner-address, but if none is found it
works as before:


diff -urN  a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
--- a/net/xfrm/xfrm_state.c 2007-05-11 15:37:35.000000000 +0300
+++ b/net/xfrm/xfrm_state.c 2007-05-11 15:37:35.000000000 +0300
@@ -374,6 +374,17 @@
                                    (best->km.dying == x->km.dying &&
                                     best->curlft.add_time < x->curlft.add_time))
                                        best = x;
+                               else if (pol->selector.family == x->sel.family &&
+                                        (pol->selector.family == AF_INET6 &&
+                                         !ipv6_addr_cmp((struct in6_addr *)&pol->selector.daddr,
+                                                        (struct in6_addr *)&x->sel.daddr) &&
+                                         !ipv6_addr_cmp((struct in6_addr *)&pol->selector.saddr,
+                                                        (struct in6_addr *)&x->sel.saddr)) ||
+                                        (pol->selector.family == AF_INET &&
+                                         pol->selector.daddr.a4 == x->sel.daddr.a4 &&
+                                         pol->selector.saddr.a4 == x->sel.saddr.a4))
+                                       best = x;
+
                        } else if (x->km.state == XFRM_STATE_ACQ) {
                                acquire_in_progress = 1;
                        } else if (x->km.state == XFRM_STATE_ERROR ||

br, j

--
Joakim Koskela
Helsinki Institute for Information Technology, http://www.hiit.fi

Re: Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

[Patrick McHardy]

Joakim Koskela wrote:
> I'm running a system where there might be multiple simultenously
> active ipsec states between two hosts (ipv6, but guess it applies to
> v4 as well) where the outer ip is the same for all states, but the
> inner differ (using beet mode).
> 
> The problem is that after establishing these states, it seems that the
> one associated with outgoing traffic is selected solely by the outer
> address (the first state matching the outer ip-pairs is used), which
> usually results in the wrong spi and the packet being dropped at the
> receiver.


This should only pick states matching the flow:

if (x->km.state == XFRM_STATE_VALID) {


        if (!xfrm_selector_match(&x->sel, fl, family) ||
            !security_xfrm_state_pol_flow_match(x, pol, fl))
                continue;
...

I'm probably misunderstanding your configuration, could you post the
SA selectors and addresses that result in an incorrect state being
picked?

Re: Problem with xfrm (ipsec) as state/spi selected solely on outer ip addresses

[Joakim Koskela]

On Friday 11 May 2007 19:13:41 Patrick McHardy wrote:
> Joakim Koskela wrote:
> > I'm running a system where there might be multiple simultenously
> > active ipsec states between two hosts (ipv6, but guess it applies to
> > v4 as well) where the outer ip is the same for all states, but the
> > inner differ (using beet mode).
> >
> > The problem is that after establishing these states, it seems that the
> > one associated with outgoing traffic is selected solely by the outer
> > address (the first state matching the outer ip-pairs is used), which
> > usually results in the wrong spi and the packet being dropped at the
> > receiver.
>
> This should only pick states matching the flow:
>
> if (x->km.state == XFRM_STATE_VALID) {
>
>
>         if (!xfrm_selector_match(&x->sel, fl, family) ||
>             !security_xfrm_state_pol_flow_match(x, pol, fl))
>                 continue;
> ...
>
> I'm probably misunderstanding your configuration, could you post the
> SA selectors and addresses that result in an incorrect state being
> picked?
>
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Oh, your right. I wasn't setting the netmask correctly (zero) for the 
selectors, making them match anything. Sorry for the waste of time!

br, j

-- 
Joakim Koskela
Helsinki Institute for Information Technology (HIIT)