netdev - Re: [PATCH iproute2] iptunnel: detect protocol mismatch on tunnel change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230411094929.5d80ef23@hermes.local>
Date:   Tue, 11 Apr 2023 09:49:29 -0700
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     David Ahern <dsahern@...nel.org>
Cc:     netdev@...r.kernel.org, bluca@...ian.org, Robin <imer@...r.cc>
Subject: Re: [PATCH iproute2] iptunnel: detect protocol mismatch on tunnel
 change

On Tue, 11 Apr 2023 09:55:25 -0600
David Ahern <dsahern@...nel.org> wrote:

> That addresses the stack smashing, but ....
> 
> >  
> >  				if (tnl_get_ioctl(*argv, &old_p))
> >  					return -1;
> > -				*p = old_p;
> > +
> > +				if (old_p.ip_tnl.iph.version != 4 ||
> > +				    old_p.ip_tnl.iph.ihl != 5)  
> 
> this field overlays laddr in ip6_tnl_parm2 which means there is a
> collision in valid addresses.

That is why the commit message said this is best effort.
What happens when there is a collision with a valid address is that
the call will fail later as a bogus change to an IP6 tunnel.

 # ip tunnel add gre1 mode ip6gre local 4545:db8::1 remote 2001:db8::2 ttl 255
 # ip tunnel change gre1 mode gre local 192.168.0.0 remote 192.168.0.1 ttl 255
ttl != 0 and nopmtudisc are incompatible

This is off in the non-standard IPv6 address range so not a likely
to bother anyone.