summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEldad Zack <eldad@fogrefinery.com>2012-04-13 01:36:17 +0400
committerDavid S. Miller <davem@davemloft.net>2012-04-13 01:36:44 +0400
commitc1412fce7eccae62b4de22494f6ab3ff8a90c0c6 (patch)
tree57ac851f1858a7641cc3a83c486491d4ed1bcd18
parent46ba5b23c32667821b748b4e0b74667e750621cd (diff)
downloadlinux-c1412fce7eccae62b4de22494f6ab3ff8a90c0c6.tar.xz
net/ipv6/exthdrs.c: Strict PadN option checking
Added strict checking of PadN, as PadN can be used to increase header size and thus push the protocol header into the 2nd fragment. PadN is used to align the options within the Hop-by-Hop or Destination Options header to 64-bit boundaries. The maximum valid size is thus 7 bytes. RFC 4942 recommends to actively check the "payload" itself and ensure that it contains only zeroes. See also RFC 4942 section 2.1.9.5. Signed-off-by: Eldad Zack <eldad@fogrefinery.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/ipv6/exthdrs.c16
1 files changed, 16 insertions, 0 deletions
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index c486b8e1817f..aa0a51e64682 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -153,6 +153,7 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
while (len > 0) {
int optlen = nh[off + 1] + 2;
+ int i;
switch (nh[off]) {
case IPV6_TLV_PAD0:
@@ -160,6 +161,21 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
break;
case IPV6_TLV_PADN:
+ /* RFC 2460 states that the purpose of PadN is
+ * to align the containing header to multiples
+ * of 8. 7 is therefore the highest valid value.
+ * See also RFC 4942, Section 2.1.9.5.
+ */
+ if (optlen > 7)
+ goto bad;
+ /* RFC 4942 recommends receiving hosts to
+ * actively check PadN payload to contain
+ * only zeroes.
+ */
+ for (i = 2; i < optlen; i++) {
+ if (nh[off + i] != 0)
+ goto bad;
+ }
break;
default: /* Other TLV code so scan list */