netdev - Re: [NET]: Fix fib_rules compatibility breakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20070324.124824.122609737.davem@davemloft.net>
Date:	Sat, 24 Mar 2007 12:48:24 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	kaber@...sh.net
Cc:	tgraf@...g.ch, netdev@...r.kernel.org, lartc@...lman.ds9a.nl
Subject: Re: [NET]: Fix fib_rules compatibility breakage

From: Patrick McHardy <kaber@...sh.net>
Date: Tue, 20 Mar 2007 20:58:55 +0100

> Thomas Graf wrote:
> > * Patrick McHardy <kaber@...sh.net> 2007-03-20 17:59
> > 
> >>The presence of the attributes when src_len/dst_len is non-zero
> >>is only verified in fib_newrule, so this looks like it might crash
> >>when something broken sets src_len/dst_len to a non-zero value
> >>without actually adding the attributes.
> > 
> > 
> > You're right, we need to validate in fib_nl_delrule() as well.
> > 
> > Based on Patrick's patch:
> > The fib_rules netlink attribute policy introduced in 2.6.19 broke
> > userspace compatibilty. When specifying a rule with "from all"
> > or "to all", iproute adds a zero byte long netlink attribute,
> > but the policy requires all addresses to have a size equal to
> > sizeof(struct in_addr)/sizeof(struct in6_addr), resulting in a
> > validation error.
> > 
> > Check attribute length of FRA_SRC/FRA_DST in the generic framework
> > by letting the family specific rules implementation provide the
> > length of an address. Report an error if address length is non
> > zero but no address attribute is provided. Fix actual bug by
> > checking address length for non-zero instead of relying on
> > availability of attribute.
> > 
> > Signed-off-by: Thomas Graf <tgraf@...g.ch>
> 
> This looks good, thanks.
> 
> Signed-off-by: Patrick McHardy <kaber@...sh.net>

Applied, thanks guys, I'll push this to 2.6.20-stable as well.

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html