[RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits

Hi,

here is a patch to fix alignment of IPv4 AH. Note that this break compatiblity for some algorithms (like SHA256) with old kernels ... but upstream cannot use SHA256 on IPv4, for example, with a target that is RFC compliant.

I don't know what is the best way to fix this.


Regards,
Nicolas

From: Nicolas Dichtel <redacted>
Date: Thu, 13 Jan 2011 18:20:19 +0100

here is a patch to fix alignment of IPv4 AH. Note that this break
compatiblity for some algorithms (like SHA256) with old kernels
... but upstream cannot use SHA256 on IPv4, for example, with a target
that is RFC compliant.

I don't know what is the best way to fix this.

We cannot just start rejecting the old 8-byte alignment on input if
Linux has been using an 8-byte alignment since day one.

If you want this change to be considered seriously, you need to relax
the AH4 input check.

David Miller [off-list ref] wrote:

We cannot just start rejecting the old 8-byte alignment on input if
Linux has been using an 8-byte alignment since day one.

If you want this change to be considered seriously, you need to relax
the AH4 input check.

I second your sentiment.  However, in this particular case it
would appear that our old implementation was also overly strict
in rejecting 32-bit alignment so even if we relax it now it still
wouldn't work with an old implementation once we reduce the padding
on output (unless you traffic was one-way only).

So perhaps an SA configuration flag is needed?

Cheers,
-- 
Email: Herbert Xu [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

On 28/01/2011 05:51, Herbert Xu wrote:

David Miller[off-list ref]  wrote:

quoted

We cannot just start rejecting the old 8-byte alignment on input if
Linux has been using an 8-byte alignment since day one.

If you want this change to be considered seriously, you need to relax
the AH4 input check.

I second your sentiment.  However, in this particular case it
would appear that our old implementation was also overly strict
in rejecting 32-bit alignment so even if we relax it now it still
wouldn't work with an old implementation once we reduce the padding
on output (unless you traffic was one-way only).

Yes, this was my initial problem.

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.


Regards,
Nicolas

From: Nicolas Dichtel <redacted>
Date: Fri, 28 Jan 2011 09:51:40 +0100

On 28/01/2011 05:51, Herbert Xu wrote:

quoted

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.

Sounds good to me.

On 28/01/2011 20:46, David Miller wrote:

From: Nicolas Dichtel<redacted>
Date: Fri, 28 Jan 2011 09:51:40 +0100

quoted

On 28/01/2011 05:51, Herbert Xu wrote:

quoted

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.

Sounds good to me.

Here is the new patch.

The patch for iproute2 in the next email.

Regards,
Nicolas

On 28/01/2011 20:46, David Miller wrote:

From: Nicolas Dichtel<redacted>
Date: Fri, 28 Jan 2011 09:51:40 +0100

quoted

On 28/01/2011 05:51, Herbert Xu wrote:

quoted

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.

Sounds good to me.

And the patch for iproute2.


Regards,
Nicolas

On 02/02/2011 17:30, Nicolas Dichtel wrote:

On 28/01/2011 20:46, David Miller wrote:

quoted

From: Nicolas Dichtel<redacted>
Date: Fri, 28 Jan 2011 09:51:40 +0100

quoted

On 28/01/2011 05:51, Herbert Xu wrote:

quoted

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.

Sounds good to me.

And the patch for iproute2.

Sorry, two patches were mixed :(

Here is the right one.


Regards,
Nicolas

From: Nicolas Dichtel <redacted>
Date: Wed, 02 Feb 2011 17:29:02 +0100

On 28/01/2011 20:46, David Miller wrote:

quoted

From: Nicolas Dichtel<redacted>
Date: Fri, 28 Jan 2011 09:51:40 +0100

quoted

On 28/01/2011 05:51, Herbert Xu wrote:

quoted

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.

Sounds good to me.

Here is the new patch.

I've applied this to net-next-2.6, thanks.

Hi,

what is the status of this patch? It has been set to 'Superseded' in the patchwork tool (http://patchwork.ozlabs.org/patch/81486/).
Kernel headers have been updated in iproute2, should I resend the patch?


Regards,
Nicolas

On 02/02/2011 17:34, Nicolas Dichtel wrote:

On 02/02/2011 17:30, Nicolas Dichtel wrote:

quoted

On 28/01/2011 20:46, David Miller wrote:

quoted

From: Nicolas Dichtel<redacted>
Date: Fri, 28 Jan 2011 09:51:40 +0100

quoted

On 28/01/2011 05:51, Herbert Xu wrote:

quoted

So perhaps an SA configuration flag is needed?

I agree. If David is ok, I will update the patch.

Sounds good to me.

And the patch for iproute2.

Sorry, two patches were mixed :(

Here is the right one.


Regards,
Nicolas

It is in net-next branch of iproute

--