lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220720082435.GA31932@debian> Date: Wed, 20 Jul 2022 10:28:34 +0200 From: Mathias Lark <mathiaslark@...il.com> To: davem@...emloft.net, yoshfuji@...ux-ipv6.org, dsahern@...nel.org, kuba@...nel.org, pabeni@...hat.com, pablo@...filter.org, kadlec@...filter.org, fw@...len.de, netdev@...r.kernel.org, netfilter-devel@...r.kernel.org, coreteam@...filter.org Subject: [PATCH v2] net-next: improve handling of ICMP_EXT_ECHO icmp type Introduce a helper for icmp type checking - icmp_is_valid_type. There is a number of code paths handling ICMP packets. To check icmp type validity, some of those code paths perform the check `type <= NR_ICMP_TYPES`. Since the introduction of ICMP_EXT_ECHO and ICMP_EXT_ECHOREPLY (RFC 8335), this check is no longer correct. To fix this inconsistency and avoid further problems with future ICMP types, the patch inserts the icmp_is_valid type helper wherever it is required. The helper checks if the type is less than NR_ICMP_TYPES or is equal to ICMP_EXT_ECHO/REPLY. NR_ICMP_TYPES could theoretically be increased to ICMP_EXT_ECHOREPLY (43), but that would not make sense as types 19-41 are not used. Signed-off-by: Mathias Lark <mathias.lark@...il.com> --- include/linux/icmp.h | 4 ++++ net/ipv4/icmp.c | 8 +++----- net/netfilter/nf_conntrack_proto_icmp.c | 4 +--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/include/linux/icmp.h b/include/linux/icmp.h index 0af4d210ee31..e979c80696b0 100644 --- a/include/linux/icmp.h +++ b/include/linux/icmp.h @@ -36,6 +36,11 @@ static inline bool icmp_is_err(int type) return false; } +static inline bool icmp_is_valid_type(int type) +{ + return type <= NR_ICMP_TYPES || type == ICMP_EXT_ECHO || type == ICMP_EXT_ECHOREPLY; +} + void ip_icmp_error_rfc4884(const struct sk_buff *skb, struct sock_ee_data_rfc4884 *out, int thlen, int off); diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 236debd9fded..686f3133370f 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -273,7 +273,7 @@ EXPORT_SYMBOL(icmp_global_allow); static bool icmpv4_mask_allow(struct net *net, int type, int code) { - if (type > NR_ICMP_TYPES) + if (!icmp_is_valid_type(type)) return true; /* Don't limit PMTU discovery. */ @@ -661,7 +661,7 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, * Assume any unknown ICMP type is an error. This * isn't specified by the RFC, but think about it.. */ - if (*itp > NR_ICMP_TYPES || + if (!icmp_is_valid_type(*itp) || icmp_pointers[*itp].error) goto out; } @@ -1225,12 +1225,10 @@ int icmp_rcv(struct sk_buff *skb) } /* - * 18 is the highest 'known' ICMP type. Anything else is a mystery - * * RFC 1122: 3.2.2 Unknown ICMP messages types MUST be silently * discarded. */ - if (icmph->type > NR_ICMP_TYPES) { + if (!icmp_is_valid_type(icmph->type)) { reason = SKB_DROP_REASON_UNHANDLED_PROTO; goto error; } diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c index b38b7164acd5..ba4462c393be 100644 --- a/net/netfilter/nf_conntrack_proto_icmp.c +++ b/net/netfilter/nf_conntrack_proto_icmp.c @@ -225,12 +225,10 @@ int nf_conntrack_icmpv4_error(struct nf_conn *tmpl, } /* - * 18 is the highest 'known' ICMP type. Anything else is a mystery - * * RFC 1122: 3.2.2 Unknown ICMP messages types MUST be silently * discarded. */ - if (icmph->type > NR_ICMP_TYPES) { + if (!icmp_is_valid_type(icmph->type)) { icmp_error_log(skb, state, "invalid icmp type"); return -NF_ACCEPT; } -- 2.36.1
Powered by blists - more mailing lists