netdev - Re: [PATCH net] net: bridge: remove ipv6 zero address check in mcast queries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 29 Oct 2018 09:33:16 +0800
From:   Hangbin Liu <liuhangbin@...il.com>
To:     Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
Cc:     netdev@...r.kernel.org, roopa@...ulusnetworks.com,
        davem@...emloft.net, yinxu@...hat.com,
        bridge@...ts.linux-foundation.org
Subject: Re: [PATCH net] net: bridge: remove ipv6 zero address check in mcast
 queries

On Sat, Oct 27, 2018 at 12:07:47PM +0300, Nikolay Aleksandrov wrote:
> Recently a check was added which prevents marking of routers with zero
> source address, but for IPv6 that cannot happen as the relevant RFCs
> actually forbid such packets:
> RFC 2710 (MLDv1):
> "To be valid, the Query message MUST
>  come from a link-local IPv6 Source Address, be at least 24 octets
>  long, and have a correct MLD checksum."
> 
> Same goes for RFC 3810.
> 
> And also it can be seen as a requirement in ipv6_mc_check_mld_query()
> which is used by the bridge to validate the message before processing
> it. Thus any queries with :: source address won't be processed anyway.
> So just remove the check for zero IPv6 source address from the query
> processing function.
> 
> Fixes: 5a2de63fd1a5 ("bridge: do not add port to router list when receives query with source 0.0.0.0")
> Signed-off-by: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>

Opps.. Sorry for the mistake and thank you for your fix.

Regards
Hangbin

> ---
>  net/bridge/br_multicast.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
> index 41cdafbf2ebe..6bac0d6b7b94 100644
> --- a/net/bridge/br_multicast.c
> +++ b/net/bridge/br_multicast.c
> @@ -1428,8 +1428,7 @@ static void br_multicast_query_received(struct net_bridge *br,
>  	 * is 0.0.0.0 should not be added to router port list.
>  	 */
>  	if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
> -	    (saddr->proto == htons(ETH_P_IPV6) &&
> -	     !ipv6_addr_any(&saddr->u.ip6)))
> +	    saddr->proto == htons(ETH_P_IPV6))
>  		br_multicast_mark_router(br, port);
>  }
>  
> -- 
> 2.17.2
>