* [PATCH 1/3] [IPV6]: Restore semantics of Routing Header processing.
@ 2007-06-18 6:04 YOSHIFUJI Hideaki / 吉藤英明
2007-06-18 18:16 ` Vlad Yasevich
0 siblings, 1 reply; 4+ messages in thread
From: YOSHIFUJI Hideaki / 吉藤英明 @ 2007-06-18 6:04 UTC (permalink / raw)
To: davem; +Cc: pekkas, yoshfuji, netdev
The "fix" for emerging security threat was overkill and it broke
basic semantic of IPv6 routing header processing. We should assume
RT0 (or even RT2, depends on configuration) as "unknown" RH type so
that we
- silently ignore the routing header if segleft == 0
- send ICMPv6 Parameter Problem message back to the sender,
otherwise.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6•org>
---
net/ipv6/exthdrs.c | 47 ++++++++++++++++-------------------------------
1 files changed, 16 insertions(+), 31 deletions(-)
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 14be0b9..05e9bb5 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -371,22 +371,13 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
struct rt0_hdr *rthdr;
int accept_source_route = ipv6_devconf.accept_source_route;
- if (accept_source_route < 0 ||
- ((idev = in6_dev_get(skb->dev)) == NULL)) {
- kfree_skb(skb);
- return -1;
- }
- if (idev->cnf.accept_source_route < 0) {
+ idev = in6_dev_get(skb->dev);
+ if (idev) {
+ if (accept_source_route > idev->cnf.accept_source_route)
+ accept_source_route = idev->cnf.accept_source_route;
in6_dev_put(idev);
- kfree_skb(skb);
- return -1;
}
- if (accept_source_route > idev->cnf.accept_source_route)
- accept_source_route = idev->cnf.accept_source_route;
-
- in6_dev_put(idev);
-
if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
!pskb_may_pull(skb, (skb_transport_offset(skb) +
((skb_transport_header(skb)[1] + 1) << 3)))) {
@@ -398,24 +389,6 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
- switch (hdr->type) {
-#ifdef CONFIG_IPV6_MIP6
- case IPV6_SRCRT_TYPE_2:
- break;
-#endif
- case IPV6_SRCRT_TYPE_0:
- if (accept_source_route > 0)
- break;
- kfree_skb(skb);
- return -1;
- default:
- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
- IPSTATS_MIB_INHDRERRORS);
- icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
- (&hdr->type) - skb_network_header(skb));
- return -1;
- }
-
if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
skb->pkt_type != PACKET_HOST) {
IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -454,6 +427,8 @@ looped_back:
switch (hdr->type) {
case IPV6_SRCRT_TYPE_0:
+ if (accept_source_route <= 0)
+ goto unknown_rh;
if (hdr->hdrlen & 0x01) {
IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
IPSTATS_MIB_INHDRERRORS);
@@ -465,6 +440,8 @@ looped_back:
break;
#ifdef CONFIG_IPV6_MIP6
case IPV6_SRCRT_TYPE_2:
+ if (accept_source_route < 0)
+ goto unknown_rh;
/* Silently discard invalid RTH type 2 */
if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -474,6 +451,8 @@ looped_back:
}
break;
#endif
+ default:
+ goto unknown_rh;
}
/*
@@ -577,6 +556,12 @@ looped_back:
skb_push(skb, skb->data - skb_network_header(skb));
dst_input(skb);
return -1;
+
+unknown_rh:
+ IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+ icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
+ (&hdr->type) - skb_network_header(skb));
+ return -1;
}
static struct inet6_protocol rthdr_protocol = {
--
1.5.1
--
YOSHIFUJI Hideaki @ USAGI Project <yoshfuji@linux-ipv6•org>
GPG-FP : 9022 65EB 1ECF 3AD1 0BDF 80D8 4807 F894 E062 0EEA
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH 1/3] [IPV6]: Restore semantics of Routing Header processing.
2007-06-18 6:04 [PATCH 1/3] [IPV6]: Restore semantics of Routing Header processing YOSHIFUJI Hideaki / 吉藤英明
@ 2007-06-18 18:16 ` Vlad Yasevich
[not found] ` <20070709.143250.132417671.davem@davemloft.net>
0 siblings, 1 reply; 4+ messages in thread
From: Vlad Yasevich @ 2007-06-18 18:16 UTC (permalink / raw)
To: YOSHIFUJI Hideaki / 吉藤英明
Cc: davem, pekkas, netdev
YOSHIFUJI Hideaki / 吉藤英明 wrote:
> IPSTATS_MIB_INHDRERRORS);
> @@ -465,6 +440,8 @@ looped_back:
> break;
> #ifdef CONFIG_IPV6_MIP6
> case IPV6_SRCRT_TYPE_2:
> + if (accept_source_route < 0)
> + goto unknown_rh;
> /* Silently discard invalid RTH type 2 */
> if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
> IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
Do we really want to do this. The IPv6 working group is bending over backwards
in it's attempt to _not_ break MIPv6 while deprecating RH0. The ability to "break"
MIPv6 by disable RH2 without disabling the rest of MIP seems a "bad thing" to me.
-vlad
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-07-10 3:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-06-18 6:04 [PATCH 1/3] [IPV6]: Restore semantics of Routing Header processing YOSHIFUJI Hideaki / 吉藤英明
2007-06-18 18:16 ` Vlad Yasevich
[not found] ` <20070709.143250.132417671.davem@davemloft.net>
2007-07-10 1:27 ` Vlad Yasevich
2007-07-10 3:42 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox