netdev - Re: [PATCH net] ipv6: sr: fix TLVs not being copied using setsockopt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 7 Jan 2018 16:55:22 +0000
From:   Mathieu Xhonneux <m.xhonneux@...il.com>
To:     netdev@...r.kernel.org
Cc:     David Lebrun <dlebrun@...gle.com>,
        Mathieu Xhonneux <m.xhonneux@...il.com>
Subject: Re: [PATCH net] ipv6: sr: fix TLVs not being copied using setsockopt

Just realized I messed up the justification about sr_has_hmac. The
branch will be taken, but its execution will not complete since the
TLV's len and type fields aren't copied, hence seg6_get_tlv_hmac will
fail, and the HMAC will not be computed.

2018-01-07 17:12 GMT+00:00 Mathieu Xhonneux <m.xhonneux@...il.com>:
> Function ipv6_push_rthdr4 allows to add an IPv6 Segment Routing Header
> to a socket through setsockopt, but the current implementation doesn't
> copy possible TLVs at the end of the SRH (i.e., the following branch
> if (sr_has_hmac(sr_phdr)) will never be taken as no HMAC TLV is copied).
>
> This commit adds a memcpy in case TLVs have been appended to the SRH.
>
> Fixes: a149e7c7ce812561f0fdc7a86ddc42f294e5eb3e ("ipv6: sr: add
> support for SRH injection through setsockopt")
> Acked-by: David Lebrun <dlebrun@...gle.com>
> Signed-off-by: Mathieu Xhonneux <m.xhonneux@...il.com>
> ---
>  net/ipv6/exthdrs.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 83bd75713535..bc68eb661970 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -925,6 +925,15 @@ static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
>         sr_phdr->segments[0] = **addr_p;
>         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
>
> +       if (sr_ihdr->hdrlen > hops * 2) {
> +               int tlvs_offset, tlvs_length;
> +
> +               tlvs_offset = (1 + hops * 2) << 3;
> +               tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
> +               memcpy((char *)sr_phdr + tlvs_offset,
> +                      (char *)sr_ihdr + tlvs_offset, tlvs_length);
> +       }
> +
>  #ifdef CONFIG_IPV6_SEG6_HMAC
>         if (sr_has_hmac(sr_phdr)) {
>                 struct net *net = NULL;
> --
> 2.15.1
>