Bug 1847766
| Summary: | subsequent xfrmi interfaces configured outside of libreswan are not recognised properly | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Paul Wouters <pwouters> |
| Component: | libreswan | Assignee: | Paul Wouters <pwouters> |
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.3 | CC: | omoris, pasik |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 03:18:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (libreswan bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:4722 |
The detection code for whether an xfrmi interface already exists did not check any interface IDs after the first one. Since the else loop contains a passert() this could in theory cause a crash and restart of libreswan. Found by coverity: libreswan-3.32/programs/pluto/kernel_xfrm_interface.c:620: unreachable: Since the loop increment "h = h->next;" is unreachable, the loop body will never execute more than once. # 618| struct pluto_xfrmi *ret = NULL; # 619| # 620|-> for (h = pluto_xfrm_interfaces; h != NULL; h = h->next) { # 621| if (h->if_id == if_id) # 622| ret = h; break The if statement should have had braces that included the break. Error introduced in original commit for xfrmi support in libreswan 3.25