netdev - ICMPV6 param problem with new error code 3 for first fragment not having valid upper layer header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 12 May 2020 05:48:06 +0000
From:   Preethi Ramachandra <preethir@...iper.net>
To:     "linux-net@...r.kernel.org" <linux-net@...r.kernel.org>,
        "yoshfuji@...ux-ipv6.org" <yoshfuji@...ux-ipv6.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: ICMPV6 param problem with new error code 3 for first fragment not
 having valid upper layer header

As per is_ineligible implementation in net/ipv6/icmp.c. If the incoming icmp is an error or is truncated, responses will not be sent out.
RFC8200 and RFC 7112 states the following:

        “If the first fragment does not include all headers through an
         Upper-Layer header, then that fragment should be discarded and
         an ICMP Parameter Problem, Code 3, message should be sent to
         the source of the fragment, with the Pointer field set to zero.”

In IPV6 TC’s derived from latest RFC 8200 https://www.ipv6ready.org/docs/Core_Conformance_5_0_0.pdf - TC 1.3.6, there is a possibility of next header set to 58(NEXTHDR_ICMP) but there is no ICMP header in first fragment. Second fragment has ICMP header. In this case RFC expects to discard the first fragment and send ICMPV6 param problem with new error code 3. I don’t see this being implemented in latest linux upstream code. Is it ok to change is_ineligible in linux for this specific case?

Linux source code:

/*
* Figure out, may we reply to this packet with icmp error.
*
* We do not reply, if:
*              - it was icmp error message.
*              - it is truncated, so that it is known, that protocol is ICMPV6
*                (i.e. in the middle of some exthdr)
*
*              --ANK (980726)
*/

static bool is_ineligible(const struct sk_buff *skb)
{
                int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
                int len = skb->len - ptr;
                __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
                __be16 frag_off;

                if (len < 0)
                                return true;

                ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
                if (ptr < 0)
                                return false;
                if (nexthdr == IPPROTO_ICMPV6) {
                                u8 _type, *tp;
                                tp = skb_header_pointer(skb,
                                                ptr+offsetof(struct icmp6hdr, icmp6_type),
                                                sizeof(_type), &_type);
                                if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
                                                return true;
                }
                return false;
}

Thanks,
Preethi

Juniper Business Use Only