Commit ea9884b3 authored Dec 16, 2013 by Fan Du Committed by Steffen Klassert Dec 16, 2013

xfrm: check user specified spi for IPComp



IPComp connection between two hosts is broken if given spi bigger
than 0xffff.

OUTSPI=0x87
INSPI=0x11112

ip xfrm policy update dst 192.168.1.101 src 192.168.1.109 dir out action allow \
       tmpl dst 192.168.1.101 src 192.168.1.109 proto comp spi $OUTSPI
ip xfrm policy update src 192.168.1.101 dst 192.168.1.109 dir in action allow \
       tmpl src 192.168.1.101 dst 192.168.1.109 proto comp spi $INSPI

ip xfrm state add src 192.168.1.101 dst 192.168.1.109  proto comp spi $INSPI \
		comp deflate
ip xfrm state add dst 192.168.1.101 src 192.168.1.109  proto comp spi $OUTSPI \
		comp deflate

tcpdump can capture outbound ping packet, but inbound packet is
dropped with XfrmOutNoStates errors. It looks like spi value used
for IPComp is expected to be 16bits wide only.

Signed-off-by: Fan Du <fan.du@windriver.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 0e0d44ab

net/xfrm/xfrm_user.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -181,7 +181,9 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
		attrs[XFRMA_ALG_AEAD] \|\|
		attrs[XFRMA_ALG_CRYPT] \|\|
		attrs[XFRMA_ALG_COMP] \|\|
		attrs[XFRMA_TFCPAD])
		attrs[XFRMA_TFCPAD] \|\|
		(ntohl(p->id.spi) >= 0x10000))

		goto out;
		break;

Admin message