lkml.org 
[lkml]   [2017]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: WARNING in xfrm_state_fini
On Mon, Nov 27, 2017 at 3:55 AM, Steffen Klassert
<steffen.klassert@secunet.com> wrote:
> On Tue, Nov 21, 2017 at 06:44:04PM -0800, Cong Wang wrote:
>> User-space uses proto==0 as a wildcard, but xfrm_id_proto_match()
>> doesn't consider it as a match with IPSEC_PROTO_ANY, in this case
>> it should match all. Not sure if the following patch is the best way to
>> fix it, or perhaps x->id.proto should be initialized to some of these 3
>> values, but looking into ->init_temprop() it is not the case.
>
> x->id is copied from the policy template and it seems that we don't
> validate the id of the template when inserting the policy. iproute2
> checks for a valid IPsec proto but the kernel does not do so. I think
> we should check the policy template and reject inserting if the proto
> is invalid.
>

Oh, I thought 0 is used as wildcard, so it is not.

Something like below?

@@ -1445,6 +1446,15 @@ static int validate_tmpl(int nr, struct
xfrm_user_tmpl *ut, u16 family)
default:
return -EINVAL;
}
+ switch (ut[i].id.proto) {
+ case IPPROTO_AH:
+ case IPPROTO_ESP:
+ case IPPROTO_COMP:
+ break;
+ default:
+ return -EINVAL;
+ }
+
}

return 0;

\
 
 \ /
  Last update: 2017-11-27 18:39    [W:0.077 / U:9.752 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site