lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Tue, 12 May 2020 05:48:06 +0000
From:   Preethi Ramachandra <>
To:     "" <>,
        "" <>,
        "" <>
Subject: ICMPV6 param problem with new error code 3 for first fragment not
 having valid upper layer header

As per is_ineligible implementation in net/ipv6/icmp.c. If the incoming icmp is an error or is truncated, responses will not be sent out.
RFC8200 and RFC 7112 states the following:

        “If the first fragment does not include all headers through an
         Upper-Layer header, then that fragment should be discarded and
         an ICMP Parameter Problem, Code 3, message should be sent to
         the source of the fragment, with the Pointer field set to zero.”

In IPV6 TC’s derived from latest RFC 8200 - TC 1.3.6, there is a possibility of next header set to 58(NEXTHDR_ICMP) but there is no ICMP header in first fragment. Second fragment has ICMP header. In this case RFC expects to discard the first fragment and send ICMPV6 param problem with new error code 3. I don’t see this being implemented in latest linux upstream code. Is it ok to change is_ineligible in linux for this specific case?

Linux source code:

* Figure out, may we reply to this packet with icmp error.
* We do not reply, if:
*              - it was icmp error message.
*              - it is truncated, so that it is known, that protocol is ICMPV6
*                (i.e. in the middle of some exthdr)
*              --ANK (980726)

static bool is_ineligible(const struct sk_buff *skb)
                int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
                int len = skb->len - ptr;
                __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
                __be16 frag_off;

                if (len < 0)
                                return true;

                ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
                if (ptr < 0)
                                return false;
                if (nexthdr == IPPROTO_ICMPV6) {
                                u8 _type, *tp;
                                tp = skb_header_pointer(skb,
                                                ptr+offsetof(struct icmp6hdr, icmp6_type),
                                                sizeof(_type), &_type);
                                if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
                                                return true;
                return false;


Juniper Business Use Only

Powered by blists - more mailing lists