| Message ID | 9ad5a4d95d70d8f75127207d796a544aed1947cc.1375417279.git.werner@almesberger.net |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Werner Almesberger <werner@almesberger.net> Date: Fri, 2 Aug 2013 10:51:34 -0300 > By using sizeof(_hdr), net/ipv6/raw.c:icmpv6_filter implicitly assumes > that any valid ICMPv6 message is at least eight bytes long, i.e., that > the message body is at least four bytes. > > The DIS message of RPL (RFC 6550 section 6.2, from the 6LoWPAN world), > has a minimum length of only six bytes, and is thus blocked by > icmpv6_filter. > > RFC 4443 seems to allow even a zero-sized body, making the minimum > allowable message size four bytes. > > Signed-off-by: Werner Almesberger <werner@almesberger.net> Applied, thanks Werner. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 164fb5f..c1e5334 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -63,6 +63,8 @@ #include <linux/seq_file.h> #include <linux/export.h> +#define ICMPV6_HDRLEN 4 /* ICMPv6 header, RFC 4443 Section 2.1 */ + static struct raw_hashinfo raw_v6_hashinfo = { .lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock), }; @@ -111,8 +113,11 @@ static int icmpv6_filter(const struct sock *sk, const struct sk_buff *skb) struct icmp6hdr _hdr; const struct icmp6hdr *hdr; + /* We require only the four bytes of the ICMPv6 header, not any + * additional bytes of message body in "struct icmp6hdr". + */ hdr = skb_header_pointer(skb, skb_transport_offset(skb), - sizeof(_hdr), &_hdr); + ICMPV6_HDRLEN, &_hdr); if (hdr) { const __u32 *data = &raw6_sk(sk)->filter.data[0]; unsigned int type = hdr->icmp6_type;
By using sizeof(_hdr), net/ipv6/raw.c:icmpv6_filter implicitly assumes that any valid ICMPv6 message is at least eight bytes long, i.e., that the message body is at least four bytes. The DIS message of RPL (RFC 6550 section 6.2, from the 6LoWPAN world), has a minimum length of only six bytes, and is thus blocked by icmpv6_filter. RFC 4443 seems to allow even a zero-sized body, making the minimum allowable message size four bytes. Signed-off-by: Werner Almesberger <werner@almesberger.net> --- net/ipv6/raw.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)