* [PATCH ipsec-next] xfrm: prevent high SEQ input in non-ESN mode
@ 2025-02-05 18:27 Leon Romanovsky
2025-02-14 9:31 ` Steffen Klassert
0 siblings, 1 reply; 2+ messages in thread
From: Leon Romanovsky @ 2025-02-05 18:27 UTC (permalink / raw)
To: Steffen Klassert
Cc: Leon Romanovsky, David S. Miller, Eric Dumazet, Herbert Xu,
Jakub Kicinski, netdev, Paolo Abeni
From: Leon Romanovsky <leonro@nvidia.com>
In non-ESN mode, the SEQ numbers are limited to 32 bits and seq_hi/oseq_hi
are not used. So make sure that user gets proper error message, in case
such assignment occurred.
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
net/xfrm/xfrm_user.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d1d422f68978..784a2d124749 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -178,6 +178,12 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
"Replay seq and seq_hi should be 0 for output SA");
return -EINVAL;
}
+ if (rs->oseq_hi && !(p->flags & XFRM_STATE_ESN)) {
+ NL_SET_ERR_MSG(
+ extack,
+ "Replay oseq_hi should be 0 in non-ESN mode for output SA");
+ return -EINVAL;
+ }
if (rs->bmp_len) {
NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA");
return -EINVAL;
@@ -190,6 +196,12 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
"Replay oseq and oseq_hi should be 0 for input SA");
return -EINVAL;
}
+ if (rs->seq_hi && !(p->flags & XFRM_STATE_ESN)) {
+ NL_SET_ERR_MSG(
+ extack,
+ "Replay seq_hi should be 0 in non-ESN mode for input SA");
+ return -EINVAL;
+ }
}
return 0;
--
2.48.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH ipsec-next] xfrm: prevent high SEQ input in non-ESN mode
2025-02-05 18:27 [PATCH ipsec-next] xfrm: prevent high SEQ input in non-ESN mode Leon Romanovsky
@ 2025-02-14 9:31 ` Steffen Klassert
0 siblings, 0 replies; 2+ messages in thread
From: Steffen Klassert @ 2025-02-14 9:31 UTC (permalink / raw)
To: Leon Romanovsky
Cc: Leon Romanovsky, David S. Miller, Eric Dumazet, Herbert Xu,
Jakub Kicinski, netdev, Paolo Abeni
On Wed, Feb 05, 2025 at 08:27:49PM +0200, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
>
> In non-ESN mode, the SEQ numbers are limited to 32 bits and seq_hi/oseq_hi
> are not used. So make sure that user gets proper error message, in case
> such assignment occurred.
>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Applied, thanks a lot!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-02-14 9:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-02-05 18:27 [PATCH ipsec-next] xfrm: prevent high SEQ input in non-ESN mode Leon Romanovsky
2025-02-14 9:31 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).