xfrm: Add dir validation to "in" data path lookup

Introduces validation for the x->dir attribute within the XFRM input
data lookup path. If the configured direction does not match the
expected direction, input, increment the XfrmInStateDirError counter
and drop the packet to ensure data integrity and correct flow handling.

grep -vw 0 /proc/net/xfrm_stat
XfrmInStateDirError     	1

Signed-off-by: Antony Antony <antony.antony@secunet.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/Documentation/networking/xfrm_proc.rst b/Documentation/networking/xfrm_proc.rst
index 5ac3acf4cf51c32161cf9b608bf64f04315c520d..973d1571acac5756b025547c0ce569a177bbc533 100644 (file)
--- a/Documentation/networking/xfrm_proc.rst
+++ b/Documentation/networking/xfrm_proc.rst
@@ -73,6 +73,9 @@ XfrmAcquireError:
 XfrmFwdHdrError:
        Forward routing of a packet is not allowed
 
+XfrmInStateDirError:
+        State direction mismatch (lookup found an output state on the input path, expected input or no direction)
+
 Outbound errors
 ~~~~~~~~~~~~~~~
 XfrmOutError:

diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index 23792b8412bd2890fc69090bc6d9db9f28cf1339..adf5fd78dd50301889a08ffedc1a59000970174b 100644 (file)
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -338,6 +338,7 @@ enum
        LINUX_MIB_XFRMOUTSTATEINVALID,          /* XfrmOutStateInvalid */
        LINUX_MIB_XFRMACQUIREERROR,             /* XfrmAcquireError */
        LINUX_MIB_XFRMOUTSTATEDIRERROR,         /* XfrmOutStateDirError */
+       LINUX_MIB_XFRMINSTATEDIRERROR,          /* XfrmInStateDirError */
        __LINUX_MIB_XFRMMAX
 };
 

diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 2c6aeb090b7ab6624edfa7038fb8660fb6a26e9c..d5bac0d76b6eb08c08cc90d0b90e54dd1c6b24de 100644 (file)
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -266,6 +266,13 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                if (!x)
                        continue;
 
+               if (unlikely(x->dir && x->dir != XFRM_SA_DIR_IN)) {
+                       XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEDIRERROR);
+                       xfrm_state_put(x);
+                       x = NULL;
+                       continue;
+               }
+
                spin_lock(&x->lock);
 
                if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) &&

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 161f535c8b9495b01f6d9689e14c40e5c0885968..71b42de6e3c9c0d5eb37f8c0574b2b931908b950 100644 (file)
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -466,6 +466,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
        if (encap_type < 0 || (xo && xo->flags & XFRM_GRO)) {
                x = xfrm_input_state(skb);
 
+               if (unlikely(x->dir && x->dir != XFRM_SA_DIR_IN)) {
+                       XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEDIRERROR);
+                       goto drop;
+               }
+
                if (unlikely(x->km.state != XFRM_STATE_VALID)) {
                        if (x->km.state == XFRM_STATE_ACQ)
                                XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
@@ -571,6 +576,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                        goto drop;
                }
 
+               if (unlikely(x->dir && x->dir != XFRM_SA_DIR_IN)) {
+                       XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEDIRERROR);
+                       xfrm_state_put(x);
+                       goto drop;
+               }
+
                skb->mark = xfrm_smark_get(skb->mark, x);
 
                sp->xvec[sp->len++] = x;

diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index 98606f1078f70a9a30fe5fd06850c36c0e73b225..eeb984be03a7968d0fb08def9ee06a8c62606d9c 100644 (file)
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -42,6 +42,7 @@ static const struct snmp_mib xfrm_mib_list[] = {
        SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID),
        SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR),
        SNMP_MIB_ITEM("XfrmOutStateDirError", LINUX_MIB_XFRMOUTSTATEDIRERROR),
+       SNMP_MIB_ITEM("XfrmInStateDirError", LINUX_MIB_XFRMINSTATEDIRERROR),
        SNMP_MIB_SENTINEL
 };