netdev - IPV6 stateless autoconfig: prefix route lifetime issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <BECE1C148A85274EB554378A3E0EDF4906335DEE@USA0300MS02.na.xerox.net>
Date:	Fri, 9 May 2008 08:55:18 -0400
From:	"Bonitch, Joseph" <Joseph.Bonitch@...ox.com>
To:	<netdev@...r.kernel.org>
Subject: IPV6 stateless autoconfig: prefix route lifetime issue

In one of our labs we have a router sending RA's where the prefix info
option has both valid and preferred lifetime set to infinity
(0xffffffff)
per RFC4861.

On a client configured for stateless address autoconfiguration, the
addresses and prefix routes are created as expected when the RA is
received,
but the prefix routes get expired after < 30 seconds.  After adding some
debug and further testing I found that when
    valid lifetime >= 0x7fffffff * HZ (HZ=250, USER_HZ=100 in our
config)
this condition occurs and prefix routes are prematurely expired.

We are using 2.6.20 + patches but I also tested with the latest Ubuntu
using
2.6.24-16 with the same results.  This is repeatable simply by booting
into
the liveCD option using Ubuntu 8.04 desktop.  No config changes
necessary -
just plug into an IPV6 network where you can change the RA Prefix Info
lifetimes.  Do "ip -6 route list" a bunch of times.  You will see the
routes
added with huge expiry times and they will count down as expected.  The
first
time fib garbage collection runs the routes disappear.  Using valid
lifetimes
such as 900, 3600, 86400, etc work just fine.

Looking at net/ipv6/addrconf.c the problem appears to be in
addrconf_prefix_rcv() after the "Avoid arithmetic overflow" comment.
Before
the comment the lifetimes have been read into valid_lft and
preferred_lft.
Clearly RFC4861 specifies that these are both u32 in units of seconds
and
0xffffffff = infinity.  Reading through RFC4862/ADDRCONF 5.5.3, there
are
no further limitations placed on the lifetimes other than the rules to
prevent the DoS case.

Problem #1 the infinity case is not specifically handled
Problem #2 premature expiration when valid_lft > 0x7ffffffff * HZ.

Let me know if further information is needed and if I should submit
a bug in bugzilla.

Regards,

Joe
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html