Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0bcbc926 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files

[IPV6]: Disallow RH0 by default. 



A security issue is emerging.  Disallow Routing Header Type 0 by default
as we have been doing for IPv4.
Note: We allow RH2 by default because it is harmless.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 05d22446

Documentation/networking/ip-sysctl.txt

+9 −0
Original line number Diff line number Diff line
@@ -851,6 +851,15 @@ accept_redirects - BOOLEAN 
	Functional default: enabled if local forwarding is disabled.

			    disabled if local forwarding is enabled.



accept_source_route - INTEGER

	Accept source routing (routing extension header).



	> 0: Accept routing header.

	= 0: Accept only routing header type 2.

	< 0: Do not accept routing header.



	Default: 0



autoconf - BOOLEAN

	Autoconfigure addresses using Prefix Information in Router 

	Advertisements.

include/linux/ipv6.h

+3 −0
Original line number Diff line number Diff line
@@ -177,6 +177,7 @@ struct ipv6_devconf { 
#endif

#endif

	__s32		proxy_ndp;

	__s32		accept_source_route;

	void		*sysctl;

};
@@ -205,6 +206,8 @@ enum { 
	DEVCONF_RTR_PROBE_INTERVAL,

	DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN,

	DEVCONF_PROXY_NDP,

	__DEVCONF_OPTIMISTIC_DAD,

	DEVCONF_ACCEPT_SOURCE_ROUTE,

	DEVCONF_MAX

};

include/linux/sysctl.h

+1 −0
Original line number Diff line number Diff line
@@ -580,6 +580,7 @@ enum { 
	NET_IPV6_RTR_PROBE_INTERVAL=21,

	NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,

	NET_IPV6_PROXY_NDP=23,

	NET_IPV6_ACCEPT_SOURCE_ROUTE=25,

	__NET_IPV6_MAX

};

net/ipv6/addrconf.c

+11 −0
Original line number Diff line number Diff line
@@ -172,6 +172,7 @@ struct ipv6_devconf ipv6_devconf __read_mostly = { 
#endif

#endif

	.proxy_ndp		= 0,

	.accept_source_route	= 0,	/* we do not accept RH0 by default. */

};



static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -203,6 +204,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { 
#endif

#endif

	.proxy_ndp		= 0,

	.accept_source_route	= 0,	/* we do not accept RH0 by default. */

};



/* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -3356,6 +3358,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, 
#endif

#endif

	array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;

	array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;

}



static inline size_t inet6_if_nlmsg_size(void)
@@ -3883,6 +3886,14 @@ static struct addrconf_sysctl_table 
			.mode		=	0644,

			.proc_handler	=	&proc_dointvec,

		},

		{

			.ctl_name	=	NET_IPV6_ACCEPT_SOURCE_ROUTE,

			.procname	=	"accept_source_route",

			.data		=	&ipv6_devconf.accept_source_route,

			.maxlen		=	sizeof(int),

			.mode		=	0644,

			.proc_handler	=	&proc_dointvec,

		},

		{

			.ctl_name	=	0,	/* sentinel */

		}

net/ipv6/exthdrs.c

+34 −6
Original line number Diff line number Diff line
@@ -362,10 +362,27 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp) 
	struct inet6_skb_parm *opt = IP6CB(skb);

	struct in6_addr *addr = NULL;

	struct in6_addr daddr;

	struct inet6_dev *idev;

	int n, i;



	struct ipv6_rt_hdr *hdr;

	struct rt0_hdr *rthdr;

	int accept_source_route = ipv6_devconf.accept_source_route;



	if (accept_source_route < 0 ||

	    ((idev = in6_dev_get(skb->dev)) == NULL)) {

		kfree_skb(skb);

		return -1;

	}

	if (idev->cnf.accept_source_route < 0) {

		in6_dev_put(idev);

		kfree_skb(skb);

		return -1;

	}



	if (accept_source_route > idev->cnf.accept_source_route)

		accept_source_route = idev->cnf.accept_source_route;



	in6_dev_put(idev);



	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||

	    !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
@@ -377,6 +394,22 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp) 


	hdr = (struct ipv6_rt_hdr *) skb->h.raw;



	switch (hdr->type) {

#ifdef CONFIG_IPV6_MIP6

		break;

#endif

	case IPV6_SRCRT_TYPE_0:

		if (accept_source_route <= 0)

			break;

		kfree_skb(skb);

		return -1;

	default:

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),

				 IPSTATS_MIB_INHDRERRORS);

		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);

		return -1;

	}



	if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||

	    skb->pkt_type != PACKET_HOST) {

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -434,11 +467,6 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp) 
		}

		break;

#endif

	default:

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),

				 IPSTATS_MIB_INHDRERRORS);

		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);

		return -1;

	}



	/*