netdev - [PATCH] ipv6: fix the bug when propagating Redirect Message

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 23 Oct 2012 23:26:25 +0800
From:	Duan Jiong <djduanjiong@...il.com>
To:	davem@...emloft.net
CC:	netdev@...r.kernel.org
Subject: [PATCH] ipv6: fix the bug when propagating Redirect Message


Before using icmpv6_notify() to propagate redirect, change skb->data
to poing the IP packet that triggered the sending of the Redirect.

Signed-off-by: Duan Jiong <djduanjiong@...il.com>
---
 net/ipv6/ndisc.c |   39 +++++++++++++++++++++++++++++++++++++++
 1 files changed, 39 insertions(+), 0 deletions(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index ff36194..0f73303 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1334,6 +1334,11 @@ out:
 
 static void ndisc_redirect_rcv(struct sk_buff *skb)
 {
+	int opt_len;
+	int opt_offset;
+	int ndisc_head_len;
+	struct nd_opt_hdr *nd_opt;
+	
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	switch (skb->ndisc_nodetype) {
 	case NDISC_NODETYPE_HOST:
@@ -1350,6 +1355,40 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
 		return;
 	}
 
+	ndisc_head_len = sizeof(struct icmp6hdr) + 2*sizeof(struct in6_addr);
+	if (!pskb_may_pull(skb, ndisc_head_len)) {
+		return;
+	}
+
+	nd_opt = (struct nd_opt_hdr *)(skb->data + ndisc_head_len);
+
+	opt_len = skb->tail - skb->transport_header - ndisc_head_len;
+	if (opt_len < 0) {
+		return;
+	}
+	while (opt_len) {
+		int l;
+	
+		if (opt_len < sizeof(struct nd_opt_hdr)) {
+			return;
+		}
+		l = nd_opt->nd_opt_len << 3;
+		if (opt_len < l || l == 0) {
+			return;
+		}
+		if (nd_opt->nd_opt_type == ND_OPT_REDIRECT_HDR) {
+			__skb_pull(skb, ndisc_head_len + opt_offset + 8);
+			break;
+		}
+		opt_len -= l;
+		nd_opt = ((void *)nd_opt) + 1;
+		opt_offset += 1;
+	}
+	
+	if (opt_len == 0) {
+		return;
+	}	
+
 	icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
 }
 
-- 
1.7.4.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html