linux-kernel - [PATCH v1 2/2] ipv6: always accept routing headers with 0 segments left

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 24 Jun 2024 16:15:33 +0200
From: Mathis Marion <Mathis.Marion@...abs.com>
To: "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        Jérôme Pouiller <jerome.pouiller@...abs.com>,
        Kylian Balan <kylian.balan@...abs.com>,
        Alexander Aring <alex.aring@...il.com>,
        Mathis Marion <mathis.marion@...abs.com>
Subject: [PATCH v1 2/2] ipv6: always accept routing headers with 0 segments left

From: Mathis Marion <mathis.marion@...abs.com>

Routing headers of type 3 and 4 would be rejected even if segments left
was 0, in the case that they were disabled through system configuration.

RFC 8200 section 4.4 specifies:

      If Segments Left is zero, the node must ignore the Routing header
      and proceed to process the next header in the packet, whose type
      is identified by the Next Header field in the Routing header.

Signed-off-by: Mathis Marion <mathis.marion@...abs.com>
---
 net/ipv6/exthdrs.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 083dbbafb166..913160b0fe13 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -662,17 +662,6 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
 		return -1;
 	}
 
-	switch (hdr->type) {
-	case IPV6_SRCRT_TYPE_4:
-		/* segment routing */
-		return ipv6_srh_rcv(skb);
-	case IPV6_SRCRT_TYPE_3:
-		/* rpl segment routing */
-		return ipv6_rpl_srh_rcv(skb);
-	default:
-		break;
-	}
-
 looped_back:
 	if (hdr->segments_left == 0) {
 		switch (hdr->type) {
@@ -708,6 +697,12 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
 		}
 		break;
 #endif
+	case IPV6_SRCRT_TYPE_3:
+		/* rpl segment routing */
+		return ipv6_rpl_srh_rcv(skb);
+	case IPV6_SRCRT_TYPE_4:
+		/* segment routing */
+		return ipv6_srh_rcv(skb);
 	default:
 		goto unknown_rh;
 	}
-- 
2.43.0