netdev - Re: [PATCH net-next] ipv6: Send ICMP errors for exceeding extension header limits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 31 May 2019 12:35:01 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     tom@...bertland.com
Cc:     netdev@...r.kernel.org, tom@...ntonium.net
Subject: Re: [PATCH net-next] ipv6: Send ICMP errors for exceeding
 extension header limits

From: Tom Herbert <tom@...bertland.com>
Date: Tue, 28 May 2019 16:32:42 -0700

> @@ -156,8 +159,11 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
>  			 * See also RFC 4942, Section 2.1.9.5.
>  			 */
>  			padlen += optlen;
> -			if (padlen > 7)
> +			if (padlen > 7) {
> +				icmpv6_send(skb, ICMPV6_PARAMPROB,
> +					    ICMPV6_TOOBIG_OPTION, off);
>  				goto bad;
> +			}

So much inconsistency.  You're sending the parameter problem here
but you're not for the following code that verifies that the padding
contains only zeros.

Either emit the parameter problem for all bad TLV padding or for none.