ipv6: add anti-spoofing checks for 6to4 and 6rd

On Fri, Jan 18, 2013 at 12:44:11AM +0900, YOSHIFUJI Hideaki wrote:
> It seems wrong.  Check should be done for
> - inner source prefix
> - embedded source with relay_prefix.
> - inner destination prefix.
> 
> Note: embedded destination is not being checked.

I fixed the handling of the embedded IPv4 in case of using 6rd
with prefixlen != 16. I'll investigate on how to easily implement
further address checks without breaking 6in4. I don't know if this is
possible without a further flag on the tunnel interface controlling
source/destination address checking.

[PATCH RFC] ipv6: add anti-spoofing checks for 6to4 and 6rd

This patch adds anti-spoofing checks in sit.c as specified in RFC3964
section 5.2 for 6to4 and RFC5969 section 12 for 6rd. I left out the
checks which could easily be implemented with netfilter.

Specifically this patch adds following logic (based loosely on the
pseudocode in RFC3964 section 5.2):

if prefix (inner_src_v6) == rd6_prefix (2002::/16 is the default)
	and outer_src_v4 != embedded_ipv4 (inner_src_v6)
		drop
if prefix (inner_dst_v6) == rd6_prefix (or 2002::/16 is the default)
	and outer_dst_v4 != embedded_ipv4 (inner_dst_v6)
		drop
accept

To accomplish the specified security checks proposed by above RFCs,
it is still necessary to employ uRPF filters with netfilter. These new
checks only kick in if the employed addresses are within the 2002::/16 or
another range specified by the 6rd-prefix (which defaults to 2002::/16).

Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
 net/ipv6/sit.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Thu, 17 Jan 2013 21:07:33 +0100

> +#ifdef CONFIG_IPV6_SIT_6RD
> +	if (ipv6_prefix_equal(addr6, &tunnel->ip6rd.prefix,
> +				tunnel->ip6rd.prefixlen) &&
> +		*addr != try_6rd(addr6, tunnel))
> +		return 0;
> +#else
> +	if (addr6->s6_addr16[0] == htons(0x2002) &&
> +		*addr != try_6rd(addr6, tunnel))
> +		return 0;
> +#endif
> +	return 1;
> +}
 ...
> +		} else if (!sit_chk_encap_addr(tunnel, &iph->saddr,
> +					&ipv6_hdr(skb)->saddr) ||
> +			!sit_chk_encap_addr(tunnel, &iph->daddr,
> +				&ipv6_hdr(skb)->daddr)) {

None of these conditionals are indented properly, please fix this up.
Both conditionals and function calls that span multiple lines must use
the column after the openning parenthesis of the initial line as the
left justification of subsequent lines.

I see what you're doing, just using TAB characters exclusively to
ident, don't do that.  You must use the appropriate combination of
TAB and space characters to achieve the correct indentaiton.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html