netdev - Re: [PATCH net v2] net: ipv6: allow explicitly choosing optimistic addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 2 Feb 2015 15:20:45 +0900
From:	Erik Kline <ek@...gle.com>
To:	Lorenzo Colitti <lorenzo@...gle.com>
Cc:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>
Subject: Re: [PATCH net v2] net: ipv6: allow explicitly choosing optimistic addresses

On Thu, Jan 29, 2015 at 2:25 PM, Lorenzo Colitti <lorenzo@...gle.com> wrote:
> On Wed, Jan 28, 2015 at 9:03 PM, Erik Kline <ek@...gle.com> wrote:
>>                 if (ipv6_addr_equal(&ifp->addr, addr) &&
>> -                   !(ifp->flags&IFA_F_TENTATIVE) &&
>> +                   (!(ifp->flags&banned_flags) ||
>> +                    ifp->flags&IFA_F_OPTIMISTIC&~banned_flags) &&
>
> Is this if statement correct?
>
> The intent here is "if ifp has IFA_F_OPTIMISTIC set, then
> IFA_F_TENTATIVE is allowed, even if the caller explicitly banned
> IFA_F_TENTATIVE", right? Not "if ifp has IFA_F_OPTIMISTIC set, then
> any flags are allowed, even ones explicitly baned by the caller". For
> example, suppose that:
>
>     banned_flags = IFA_F_SECONDARY
>     ifp->flags = IFA_F_SECONDARY | IFA_F_OPTIMISTIC
>
> In that case, won't the if statement match ifp, even though it
> contains a flag that is explicitly banned?

Yep, true.  It works for all existing inputs, but is not generally
future-proof.  :(

I have a rewrite that explicitly defines the circumstances under which
optimistic would be considered ok in this check.  If there are changes
in that definition in the future that one clause will need to be
updated accordingly.

Patch coming in minutes.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html