netdev - Re: [PATCH net v2] ipv6/netfilter: Discard first fragment not including all headers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e5b033cd-8de1-8fe6-5da9-e997a0570db1@cisco.com>
Date:   Fri, 6 Nov 2020 18:05:27 +0000
From:   "Georg Kohmann (geokohma)" <geokohma@...co.com>
To:     Jakub Kicinski <kuba@...nel.org>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "pablo@...filter.org" <pablo@...filter.org>,
        "kadlec@...filter.org" <kadlec@...filter.org>,
        "fw@...len.de" <fw@...len.de>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuznet@....inr.ac.ru" <kuznet@....inr.ac.ru>,
        "yoshfuji@...ux-ipv6.org" <yoshfuji@...ux-ipv6.org>,
        "netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
        "coreteam@...filter.org" <coreteam@...filter.org>
Subject: Re: [PATCH net v2] ipv6/netfilter: Discard first fragment not
 including all headers

On 06.11.2020 17:58, Jakub Kicinski wrote:
> On Fri,  6 Nov 2020 14:08:03 +0100 Georg Kohmann wrote:
>> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
>> index c8cf1bb..e6173f5 100644
>> --- a/net/ipv6/reassembly.c
>> +++ b/net/ipv6/reassembly.c
>> @@ -325,7 +325,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
>>  	const struct ipv6hdr *hdr = ipv6_hdr(skb);
>>  	struct net *net = dev_net(skb_dst(skb)->dev);
>>  	__be16 frag_off;
>> -	int iif, offset;
>> +	int iif;
>>  	u8 nexthdr;
>>  
>>  	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
>> @@ -362,24 +362,11 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
>>  	 * the source of the fragment, with the Pointer field set to zero.
>>  	 */
>>  	nexthdr = hdr->nexthdr;
>> -	offset = ipv6_skip_exthdr(skb, skb_transport_offset(skb), &nexthdr, &frag_off);
>> -	if (offset >= 0) {
>> -		/* Check some common protocols' header */
>> -		if (nexthdr == IPPROTO_TCP)
>> -			offset += sizeof(struct tcphdr);
>> -		else if (nexthdr == IPPROTO_UDP)
>> -			offset += sizeof(struct udphdr);
>> -		else if (nexthdr == IPPROTO_ICMPV6)
>> -			offset += sizeof(struct icmp6hdr);
>> -		else
>> -			offset += 1;
>> -
>> -		if (!(frag_off & htons(IP6_OFFSET)) && offset > skb->len) {
>> -			__IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
>> -					IPSTATS_MIB_INHDRERRORS);
>> -			icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0);
>> -			return -1;
>> -		}
>> +	if (!ipv6_frag_validate(skb, skb_transport_offset(skb), &nexthdr)) {
>> +		__IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
>> +				IPSTATS_MIB_INHDRERRORS);
>> +		icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0);
>> +		return -1;
>>  	}
> net/ipv6/reassembly.c: In function ‘ipv6_frag_rcv’:
> net/ipv6/reassembly.c:327:9: warning: unused variable ‘frag_off’ [-Wunused-variable]
>   327 |  __be16 frag_off;
>       |         ^~~~~~~~
Thanks for telling me. I will fix it.
Georg