netdev - [PATCH] ip/link_vti6.c: Fix local/remote any handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4608c5ed-6b73-4bc2-f193-66e5129d855e@secunet.com>
Date:   Mon, 7 Aug 2017 08:41:23 +0200
From:   Christian Langrock <christian.langrock@...unet.com>
To:     <netdev@...r.kernel.org>
Subject: [PATCH] ip/link_vti6.c: Fix local/remote any handling

According to the IPv4 behavior of 'ip' it should be possible to omit the
arguments for local and remote address.
Without this patch omitting these parameters would lead to
uninitialized memory being interpreted as IPv6 addresses.

Signed-off-by: Christian Langrock <christian.langrock@...unet.com>
---
 ip/link_vti6.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/ip/link_vti6.c b/ip/link_vti6.c
index be4e33c..220b7df 100644
--- a/ip/link_vti6.c
+++ b/ip/link_vti6.c
@@ -60,7 +60,9 @@ static int vti6_parse_opt(struct link_util *lu, int
argc, char **argv,
     struct rtattr *linkinfo[IFLA_INFO_MAX+1];
     struct rtattr *vtiinfo[IFLA_VTI_MAX + 1];
     struct in6_addr saddr;
+    bool use_saddr = false;
     struct in6_addr daddr;
+    bool use_daddr = false;
     unsigned int ikey = 0;
     unsigned int okey = 0;
     unsigned int link = 0;
@@ -167,6 +169,7 @@ get_failed:
 
                 get_prefix(&addr, *argv, AF_INET6);
                 memcpy(&daddr, addr.data, addr.bytelen);
+                use_daddr = true;
             }
         } else if (!matches(*argv, "local")) {
             NEXT_ARG();
@@ -178,6 +181,7 @@ get_failed:
 
                 get_prefix(&addr, *argv, AF_INET6);
                 memcpy(&saddr, addr.data, addr.bytelen);
+                use_saddr = true;
             }
         } else if (!matches(*argv, "dev")) {
             NEXT_ARG();
@@ -195,8 +199,10 @@ get_failed:
 
     addattr32(n, 1024, IFLA_VTI_IKEY, ikey);
     addattr32(n, 1024, IFLA_VTI_OKEY, okey);
-    addattr_l(n, 1024, IFLA_VTI_LOCAL, &saddr, sizeof(saddr));
-    addattr_l(n, 1024, IFLA_VTI_REMOTE, &daddr, sizeof(daddr));
+    if (use_saddr)
+        addattr_l(n, 1024, IFLA_VTI_LOCAL, &saddr, sizeof(saddr));
+    if (use_daddr)
+        addattr_l(n, 1024, IFLA_VTI_REMOTE, &daddr, sizeof(daddr));
     addattr32(n, 1024, IFLA_VTI_FWMARK, fwmark);
     if (link)
         addattr32(n, 1024, IFLA_VTI_LINK, link);
-- 
2.7.4



Download attachment "0x82EB6B5E.asc" of type "application/pgp-keys" (1728 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)