Patchwork [iproute2,1/7] ip/xfrm: Extend SPI validity checking

login
register
mail settings
Submitter David Ward
Date March 25, 2013, 2:23 p.m.
Message ID <1364221399-1024-1-git-send-email-david.ward@ll.mit.edu>
Download mbox | patch
Permalink /patch/230725/
State Accepted
Delegated to: stephen hemminger
Headers show

Comments

David Ward - March 25, 2013, 2:23 p.m.
A Security Policy Index (SPI) is not used with Mobile IPv6. IPComp
uses a smaller 16-bit Compression Parameter Index (CPI) which is
passed as the SPI value. Perform checks whenever specifying an ID.

Signed-off-by: David Ward <david.ward@ll.mit.edu>
---
 ip/ipxfrm.c     |   12 ++++++++++++
 ip/xfrm_state.c |    5 -----
 2 files changed, 12 insertions(+), 5 deletions(-)
stephen hemminger - March 25, 2013, 3:03 p.m.
On Mon, 25 Mar 2013 10:23:13 -0400
David Ward <david.ward@ll.mit.edu> wrote:

> A Security Policy Index (SPI) is not used with Mobile IPv6. IPComp
> uses a smaller 16-bit Compression Parameter Index (CPI) which is
> passed as the SPI value. Perform checks whenever specifying an ID.
> 
> Signed-off-by: David Ward <david.ward@ll.mit.edu>

These all look fine to me, I will apply them in a couple of days
unless there is anybody who sees a compatibility problem with current usage.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index db51918..2576938 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -1067,6 +1067,18 @@  int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family,
 	if (src.family && dst.family && (src.family != dst.family))
 		invarg("the same address family is required between \"src\" and \"dst\"", *argv);
 
+	if (id->spi && id->proto) {
+		if (xfrm_xfrmproto_is_ro(id->proto)) {
+			fprintf(stderr, "\"spi\" is invalid with XFRM-PROTO value \"%s\"\n",
+			        strxf_xfrmproto(id->proto));
+			exit(1);
+		} else if (id->proto == IPPROTO_COMP && ntohl(id->spi) >= 0x10000) {
+			fprintf(stderr, "SPI value is too large with XFRM-PROTO value \"%s\"\n",
+			        strxf_xfrmproto(id->proto));
+			exit(1);
+		}
+	}
+
 	if (loose == 0 && id->proto == 0)
 		missarg("XFRM-PROTO");
 	if (argc == *argcp)
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index c0cf88c..3c01ec5 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -502,11 +502,6 @@  static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
 				strxf_xfrmproto(req.xsinfo.id.proto));
 			exit(1);
 		}
-		if (req.xsinfo.id.spi != 0) {
-			fprintf(stderr, "\"spi\" must be 0 with proto=%s\n",
-				strxf_xfrmproto(req.xsinfo.id.proto));
-			exit(1);
-		}
 		break;
 	default:
 		break;