Skip to contentSkip to conversation

ipv6: routing header fixes

PATCH In review Brian Haley 2 participants 2 messages Nov 11, 2008 – Nov 13, 2008

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Brian Haley

author
#0 lore raw

PATCH 1/1 ipv6: routing header fixes

This patch fixes two bugs:

1. setsockopt() of anything but a Type 2 routing header should return EINVAL instead of EPERM. Noticed by Shan Wei ([email protected]).

2. setsockopt()/sendmsg() of a Type 2 routing header with invalid length or segments should return EINVAL. These values are statically fixed in RFC 3775, unlike the variable Type 0 was.

Signed-off-by Brian Haley <[email protected]>
net/ipv6/datagram.c +5 -0
index 410046a..e44deb8 100644
@@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net,
 			switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 			case IPV6_SRCRT_TYPE_2:
+				if (rthdr->hdrlen != 2 ||
+				    rthdr->segments_left != 1) {
+					err = -EINVAL;
+					goto exit_f;
+				}
 				break;
 #endif
 			default:
net/ipv6/ipv6_sockglue.c +5 -0
index 4e5eac3..2aa294b 100644
@@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 		}
 
 		/* routing header option needs extra check */
+		retv = -EINVAL;
 		if (optname == IPV6_RTHDR && opt && opt->srcrt) {
 			struct ipv6_rt_hdr *rthdr = opt->srcrt;
 			switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 			case IPV6_SRCRT_TYPE_2:
+				if (rthdr->hdrlen != 2 ||
+				    rthdr->segments_left != 1)
+					goto sticky_done;
+
 				break;
 #endif
 			default:
maintainer
#1 lore raw

From: Brian Haley <[email protected]>
Date: Tue, 11 Nov 2008 17:11:43 -0500

Quoted 7 lines

This patch fixes two bugs:

1. setsockopt() of anything but a Type 2 routing header should return EINVAL instead of EPERM. Noticed by Shan Wei ([email protected]).

2. setsockopt()/sendmsg() of a Type 2 routing header with invalid length or segments should return EINVAL. These values are statically fixed in RFC 3775, unlike the variable Type 0 was.

Signed-off-by Brian Haley <[email protected]>

Looks good, applied, thanks Brian.