netdev - Re: [PATCH RESEND] ipv6: add anti-spoofing checks for 6to4 and 6rd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130124135508.GE16641@order.stressinduktion.org>
Date:	Thu, 24 Jan 2013 14:55:08 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	YOSHIFUJI Hideaki <yoshfuji@...ux-ipv6.org>
Cc:	netdev@...r.kernel.org, davem@...emloft.net
Subject: Re: [PATCH RESEND] ipv6: add anti-spoofing checks for 6to4 and 6rd

On Thu, Jan 24, 2013 at 12:59:30PM +0900, YOSHIFUJI Hideaki wrote:
> I need to do more research.  I am still not convinced
> to have such destination check here because the standard
> seems silent about it, and we have several basic checks
> in standard input path and tunnel search.

Thanks, looking forward to your conclusion.

> Anyway, try_6rd() can do check for prefix as well
> but we are doing slightly different thing.
> So I think we can introduce new __check_6rd() to
> return non-6rd/6to4 addresses.
> 
> bool __check_6rd(struct ip_tunnel *tunnel,
> 		 const struct in6_addr *v6dst,
> 		 __be32 *v4dst);
> 
> If prefix matches, fill *v4dst and return true.
> Otherwise, return false.
> 
> __be32 __try_6rd()
> {
> 	__be32 dst = 0;
> 	__check_6rd(tunnel, v6dst, &dst);
> 	return dst;
> }

I'll update the patch and send it over for review, thanks.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html