Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 619f008d authored by Benedict Wong's avatar Benedict Wong Committed by Greg Kroah-Hartman
Browse files

xfrm: Check if_id in inbound policy/secpath match 



[ Upstream commit 8680407b6f8f5fba59e8f1d63c869abc280f04df ]

This change ensures that if configured in the policy, the if_id set in
the policy and secpath states match during the inbound policy check.
Without this, there is potential for ambiguity where entries in the
secpath differing by only the if_id could be mismatched.

Notably, this is checked in the outbound direction when resolving
templates to SAs, but not on the inbound path when matching SAs and
policies.

Test: Tested against Android kernel unit tests & CTS
Signed-off-by: default avatarBenedict Wong <benedictwong@google.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 21ca8170

net/xfrm/xfrm_policy.c

+6 −5
Original line number Original line Diff line number Diff line
@@ -3223,7 +3223,7 @@ xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl) 




static inline int

static inline int

xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,

xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,

	      unsigned short family)

	      unsigned short family, u32 if_id)

{

{

	if (xfrm_state_kern(x))

	if (xfrm_state_kern(x))

		return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);

		return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
@@ -3234,7 +3234,8 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, 
		(tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||

		(tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||

		 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&

		 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&

		!(x->props.mode != XFRM_MODE_TRANSPORT &&

		!(x->props.mode != XFRM_MODE_TRANSPORT &&

		  xfrm_state_addr_cmp(tmpl, x, family));

		  xfrm_state_addr_cmp(tmpl, x, family)) &&

		(if_id == 0 || if_id == x->if_id);

}

}





/*

/*
@@ -3246,7 +3247,7 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, 
 */

 */

static inline int

static inline int

xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,

xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,

	       unsigned short family)

	       unsigned short family, u32 if_id)

{

{

	int idx = start;

	int idx = start;
@@ -3256,7 +3257,7 @@ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int star 
	} else

	} else

		start = -1;

		start = -1;

	for (; idx < sp->len; idx++) {

	for (; idx < sp->len; idx++) {

		if (xfrm_state_ok(tmpl, sp->xvec[idx], family))

		if (xfrm_state_ok(tmpl, sp->xvec[idx], family, if_id))

			return ++idx;

			return ++idx;

		if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {

		if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {

			if (start == -1)

			if (start == -1)
@@ -3666,7 +3667,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, 
		 * are implied between each two transformations.

		 * are implied between each two transformations.

		 */

		 */

		for (i = xfrm_nr-1, k = 0; i >= 0; i--) {

		for (i = xfrm_nr-1, k = 0; i >= 0; i--) {

			k = xfrm_policy_ok(tpp[i], sp, k, family);

			k = xfrm_policy_ok(tpp[i], sp, k, family, if_id);

			if (k < 0) {

			if (k < 0) {

				if (k < -1)

				if (k < -1)

					/* "-2 - errored_index" returned */

					/* "-2 - errored_index" returned */