[PATCH] xfrm: validate protocol for XFRM_MODE_ROUTEOPTIMIZATION in verify_newsa_info()

[PATCH] xfrm: validate protocol for XFRM_MODE_ROUTEOPTIMIZATION in verify_newsa_info()

[Hui Peng]

In verify_newsa_info(), XFRM_MODE_ROUTEOPTIMIZATION skips the protocol
switch validation, allowing IPPROTO_ESP, IPPROTO_AH, or IPPROTO_COMP states
to be created with XFRM_MODE_ROUTEOPTIMIZATION even though only
IPPROTO_DSTOPTS and IPPROTO_ROUTING are valid IPv6 route optimization
protocols. Enforce that XFRM_MODE_ROUTEOPTIMIZATION is only used with
AF_INET6 and IPPROTO_DSTOPTS or IPPROTO_ROUTING.

Fixes: 060f02a3bdd4 ("[XFRM] STATE: Introduce care-of address.")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e796b..2be800232847 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -698,7 +705,9 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
 		NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found");
 		return -ENOSYS;
 	}
-	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) {
+	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits ||
+	    (ualg->alg_trunc_len & 7) ||
+	    (ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32)) {
 		NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV");
 		return -EINVAL;
 	}

Re: [PATCH] xfrm: validate protocol for XFRM_MODE_ROUTEOPTIMIZATION in verify_newsa_info()

[Sabrina Dubroca]

2026-09-19, 21:52:39 +0000, Hui Peng wrote:
> In verify_newsa_info(), XFRM_MODE_ROUTEOPTIMIZATION skips the protocol
> switch validation, allowing IPPROTO_ESP, IPPROTO_AH, or IPPROTO_COMP states
> to be created with XFRM_MODE_ROUTEOPTIMIZATION even though only
> IPPROTO_DSTOPTS and IPPROTO_ROUTING are valid IPv6 route optimization
> protocols. Enforce that XFRM_MODE_ROUTEOPTIMIZATION is only used with
> AF_INET6 and IPPROTO_DSTOPTS or IPPROTO_ROUTING.

That's really not what this patch does...

> Fixes: 060f02a3bdd4 ("[XFRM] STATE: Introduce care-of address.")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index a2587c7e796b..2be800232847 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -698,7 +705,9 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
>  		NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found");
>  		return -ENOSYS;
>  	}
> -	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) {
> +	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits ||
> +	    (ualg->alg_trunc_len & 7) ||
> +	    (ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32)) {
>  		NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV");
>  		return -EINVAL;
>  	}
> 

-- 
Sabrina