netdev - [IPV6] send ICMPv6 error on scope violations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <OFA075DC7D.6AB1CB33-ON882572D6.006CBBA4-882572D6.006D635E@us.ibm.com>
Date:	Wed, 9 May 2007 13:55:15 -0600
From:	David Stevens <dlstevens@...ibm.com>
To:	davem@...emloft.net
Cc:	yoshfuji@...ux-ipv6.org, netdev@...r.kernel.org
Subject: [IPV6] send ICMPv6 error on scope violations

When an IPv6 router is forwarding a packet with a link-local scope source
address off-link, RFC 4007 requires it to send an ICMPv6 destination
unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below.

                                                +-DLS
[in-line for viewing, attached for applying]

Signed-off-by: David L Stevens <dlstevens@...ibm.com>

--- linux-2.6.20.7/net/ipv6/ip6_output.c        2007-04-13 
13:48:14.000000000 -0700
+++ linux-2.6.20.7T1/net/ipv6/ip6_output.c      2007-05-09 
12:32:45.000000000 -0700
@@ -449,10 +449,17 @@ int ip6_forward(struct sk_buff *skb)
                 */
                if (xrlim_allow(dst, 1*HZ))
                        ndisc_send_redirect(skb, n, target);
-       } else if 
(ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK
-                                               |IPV6_ADDR_LINKLOCAL)) {
+       } else {
+               int addrtype = ipv6_addr_type(&hdr->saddr);
+
                /* This check is security critical. */
-               goto error;
+               if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
+                       goto error;
+               if (addrtype & IPV6_ADDR_LINKLOCAL) {
+                       icmpv6_send(skb, ICMPV6_DEST_UNREACH,
+                               ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
+                       goto error;
+               }
        }
 
        if (skb->len > dst_mtu(dst)) {



Download attachment "icmp6fix.patch" of type "application/octet-stream" (784 bytes)