From patchwork Sat Apr 7 15:16:14 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eldad Zack X-Patchwork-Id: 151303 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 523EDB70CE for ; Sun, 8 Apr 2012 01:17:02 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754856Ab2DGPQq (ORCPT ); Sat, 7 Apr 2012 11:16:46 -0400 Received: from mail-gy0-f174.google.com ([209.85.160.174]:61680 "EHLO mail-gy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753016Ab2DGPQp (ORCPT ); Sat, 7 Apr 2012 11:16:45 -0400 Received: by ghrr11 with SMTP id r11so1483100ghr.19 for ; Sat, 07 Apr 2012 08:16:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references :x-gm-message-state; bh=RMQqTdNikeMOWVO2bF1HbKQQNQk9xVsqIDwy5lGy2HA=; b=FrWqaVyBn3tNotJX/rPwNtfT88FVOB+1PSKf2rBtQf5GWTaWfrfVLamb4qbMzW5G3p HHN74jovPLnm2CItScllrinN8JcOMSTDYH5OjNASkLc4M0j5n2lI677FWMOHazt0DpL7 X0lFCbdlm8c0q60I+hTnHCaHOjcfit8KJqHk3c1+k7UO5ihakn7+zUBRHfYhohBgL/BA fQytivY7jViovGlkgU7GQdJzXAeHg43Yg2MyciA7NHnWzUqoXD450BuR8O7o7RWM1USH PDTtbaB6raaTztMDaVyLAIM5etzD4SEIqzvRWQF1kVX6bs9uwC7oboUBjpt/mD64f9TI uzPg== Received: by 10.236.154.2 with SMTP id g2mr1234648yhk.103.1333811804669; Sat, 07 Apr 2012 08:16:44 -0700 (PDT) Received: from localhost ([2001:470:8876:85cd:f705:dcd8:7cf2:7d19]) by mx.google.com with ESMTPS id v26sm41675220yhk.1.2012.04.07.08.16.43 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 07 Apr 2012 08:16:44 -0700 (PDT) From: Eldad Zack To: "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Eldad Zack Subject: [PATCH] net/ipv6/exthdrs.c et al: Optional strict PadN option checking Date: Sat, 7 Apr 2012 17:16:14 +0200 Message-Id: <1333811774-3219-1-git-send-email-eldad@fogrefinery.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: References: X-Gm-Message-State: ALoCoQk0DWNfp45EbSyO4k3DSsb1I6um+xJfTVeozPXsHD30kqioLpvAHR9fdjl3w2cui8NPncLP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Added strict checking of PadN. PadN can be used to increase header size and thus push the protocol header into the 2nd fragment. PadN is used to align the options within the Hop-by-Hop or Destination Options header to 64-bit boundaries. The maximum valid size is thus 7 bytes. RFC 4942 recommends to actively check the "payload" itself and ensure that it contains only zeroes. See also RFC 4942 section 2.1.9.5. Signed-off-by: Eldad Zack --- Documentation/networking/ip-sysctl.txt | 7 +++++++ include/net/ipv6.h | 1 + net/ipv6/exthdrs.c | 18 ++++++++++++++++++ net/ipv6/sysctl_net_ipv6.c | 7 +++++++ 4 files changed, 33 insertions(+) diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt index ad3e80e..abaa1cf 100644 --- a/Documentation/networking/ip-sysctl.txt +++ b/Documentation/networking/ip-sysctl.txt @@ -1007,6 +1007,13 @@ bindv6only - BOOLEAN Default: FALSE (as specified in RFC3493) +padn_strict - BOOLEAN + Perform strict checking of PadN. + TRUE: enable strict PadN checking + FALSE: disable strict PadN checking + + Default: FALSE + IPv6 Fragmentation: ip6frag_high_thresh - INTEGER diff --git a/include/net/ipv6.h b/include/net/ipv6.h index e4170a2..4f9af54 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -113,6 +113,7 @@ struct frag_hdr { /* sysctls */ extern int sysctl_mld_max_msf; +extern int sysctl_padn_strict; extern struct ctl_path net_ipv6_ctl_path[]; #define _DEVINC(net, statname, modifier, idev, field) \ diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c index c486b8e..ee7a05c 100644 --- a/net/ipv6/exthdrs.c +++ b/net/ipv6/exthdrs.c @@ -49,6 +49,8 @@ #include +int sysctl_padn_strict; + int ipv6_find_tlv(struct sk_buff *skb, int offset, int type) { const unsigned char *nh = skb_network_header(skb); @@ -160,6 +162,22 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb) break; case IPV6_TLV_PADN: + if (sysctl_padn_strict) { + int i; + /* RFC 2460 states that the purpose of PadN is + to align the containing header to multiples + of 8. 7 is therefore the highest valid value. + See also RFC 4942, Section 2.1.9.5.*/ + if (optlen > 7) + goto bad; + /* RFC 4942 recommends receiving hosts to + actively check PadN payload to contain + only zeroes. */ + for (i = 2; i < optlen; i++) { + if (nh[off + i] != 0) + goto bad; + } + } break; default: /* Other TLV code so scan list */ diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c index 166a57c..c7f07f9 100644 --- a/net/ipv6/sysctl_net_ipv6.c +++ b/net/ipv6/sysctl_net_ipv6.c @@ -48,6 +48,13 @@ static ctl_table ipv6_table_template[] = { .mode = 0644, .proc_handler = proc_dointvec }, + { + .procname = "padn_strict", + .data = &sysctl_padn_strict, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec + }, { } };