ipv6: do not disable temp_address when reaching max_address
Subsystems (3)
PATCH 1/2 ipv6: do not disable temp_address when reaching max_address
A LAN user can remotely disable temporary address which may lead to privacy violatins and information disclosure.
The reason is that the linux kernel uses the 'ipv6.max_addresses' option to specify how many ipv6 addresses and interface may have. The 'ipv6.regen_max_retry' (default value 3) option specifies how many times the kernel will try to create a new address.
But the kernel is not distinguish between the event of reaching max_addresses for an interface and failing to generate a new address. the kernel disable the temporary address after regenerate a new address 'regen_max_retry' times.
According RFC4941 3.3.7:
---------------------------------------
If DAD indicates the address is already in use,
the node must generate a new randomized interface
identifier as described in section 3.2 above, and
repeat the previous steps as appropriate up toTEMP_IDGEN_RETRIES times.
If after TEMP_IDGEN_RETRIES consecutive attempts no non-unique address was generated, the node must log a system error and must not attempt to generate temporary address for that interface.
------------------------------------------
RFC4941 3.3.7 specifies that disabling the temp_address must happen upon the address is already in use, not reach the max_address, So we have to check the return err and distinguish the correct retry path.
This fixes CVE-2013-0343
--- net/ipv6/addrconf.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
net/ipv6/addrconf.c +21 -4
@@ -1134,10 +1134,27 @@ retry:if (IS_ERR_OR_NULL (ift)) {in6_ifa_put (ifp);in6_dev_put (idev); -pr_info ("%s: retry temporary address regeneration\n" , __func__); - tmpaddr = &addr; -write_lock (&idev->lock); - goto retry; + +/* According RFC4941 3.3.7: +* If DAD indicates the address is already in use, +* the node must generate a new randomized interface +* identifier as described in section 3.2 above, and +* repeat the previous steps as appropriate up to +* TEMP_IDGEN_RETRIES times. +* If after TEMP_IDGEN_RETRIES consecutive attempts no +* non-unique address was generated, the node must log +* a system error and must not attempt to generate +* temporary address for that interface. +* So we have to check the return err and distinguish +* the correct retry path. +*/ +if (PTR_ERR (ift) == -EEXIST ) { +pr_info ("%s: retry temporary address regeneration\n" , __func__); + tmpaddr = &addr; +write_lock (&idev->lock); + goto retry; + }else + goto out; }spin_lock_bh (&ift->lock);
Signature · 1 line
1.8.2.1
Hello.
Quoted 48 lines · Ding Tianhong
A LAN user can remotely disable temporary address which may lead to privacy violatins and information disclosure.
The reason is that the linux kernel uses the 'ipv6.max_addresses' option to specify how many ipv6 addresses and interface may have. The 'ipv6.regen_max_retry' (default value 3) option specifies how many times the kernel will try to create a new address.
But the kernel is not distinguish between the event of reaching
max_addressesfor an interface and failing to generate a new address. the kernel disable the temporary address after regenerate a new address 'regen_max_retry' times.According RFC4941 3.3.7:
---------------------------------------
If DAD indicates the address is already in use,
the node must generate a new randomized interface
identifier as described in section 3.2 above, and
repeat the previous steps as appropriate up toTEMP_IDGEN_RETRIEStimes.If after
TEMP_IDGEN_RETRIESconsecutive attempts no non-unique address was generated, the node must log a system error and must not attempt to generate temporary address for that interface.------------------------------------------
RFC4941 3.3.7 specifies that disabling the
temp_addressmust happen upon the address is already in use, not reach themax_address, So we have to check the return err and distinguish the correct retry path.This fixes CVE-2013-0343
Signed-off-by Ding Tianhong <[email protected]>Tested-by Wang Weidong <[email protected]>Cc David S. Miller <[email protected]>--- net/ipv6/addrconf.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)net/ipv6/addrconf.c +0
-0@@ -1134,10 +1134,27 @@ retry:
[...]
net/ipv6/addrconf.c retry: · line 1157
Quoted 7 lines
net/ipv6/addrconf.c +7
-0+if (PTR_ERR (ift) == -EEXIST ) { +pr_info ("%s: retry temporary address regeneration\n" , __func__); + tmpaddr = &addr; +write_lock (&idev->lock); + goto retry; + }else + goto out;
According to CodingStyle, both arms of the *if* statement should have {}
if one has it.
WBR, Sergei
Quoted 61 lines · Sergei Shtylyov
Hello.
Quoted 48 lines · Ding Tianhong
A LAN user can remotely disable temporary address which may lead to privacy violatins and information disclosure.
The reason is that the linux kernel uses the 'ipv6.max_addresses' option to specify how many ipv6 addresses and interface may have. The 'ipv6.regen_max_retry' (default value 3) option specifies how many times the kernel will try to create a new address.
But the kernel is not distinguish between the event of reaching
max_addressesfor an interface and failing to generate a new address. the kernel disable the temporary address after regenerate a new address 'regen_max_retry' times.According RFC4941 3.3.7:
---------------------------------------
If DAD indicates the address is already in use,
the node must generate a new randomized interface
identifier as described in section 3.2 above, and
repeat the previous steps as appropriate up toTEMP_IDGEN_RETRIEStimes.If after
TEMP_IDGEN_RETRIESconsecutive attempts no non-unique address was generated, the node must log a system error and must not attempt to generate temporary address for that interface.------------------------------------------
RFC4941 3.3.7 specifies that disabling the
temp_addressmust happen upon the address is already in use, not reach themax_address, So we have to check the return err and distinguish the correct retry path.This fixes CVE-2013-0343
Signed-off-by Ding Tianhong <[email protected]>Tested-by Wang Weidong <[email protected]>Cc David S. Miller <[email protected]>--- net/ipv6/addrconf.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)net/ipv6/addrconf.c +0
-0@@ -1134,10 +1134,27 @@ retry:[...]
net/ipv6/addrconf.c retry: · line 1157
Quoted 7 lines
net/ipv6/addrconf.c +7
-0+if (PTR_ERR (ift) == -EEXIST ) { +pr_info ("%s: retry temporary address regeneration\n" , __func__); + tmpaddr = &addr; +write_lock (&idev->lock); + goto retry; + }else + goto out;
Quoted 4 lines
According to CodingStyle, both arms of the *if* statement should have {} if one has it.
WBR, Sergei
thanks your opinion. I will collect feedback and resend v3 for the patch set.
regards
Ding Tianhong
Quoted 3 lines
.