[PATCH] IPV6: Disallow RH0 by default.

[IPV6]: Disallow RH0 by default.

A security issue is emerging.  Disallow Routing Header Type 0 by default
as we have been doing for IPv4.
Note: We allow RH2 by default because it is harmless.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index a0f6842368c37b77b571c5817029adaf45db1769..713c283c25b747e3796925465f659eeb0e3af330 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -825,6 +825,15 @@ accept_redirects - BOOLEAN
        Functional default: enabled if local forwarding is disabled.
                            disabled if local forwarding is enabled.
 
+accept_source_route - INTEGER
+       Accept source routing (routing extension header).
+
+       > 0: Accept routing header.
+       = 0: Accept only routing header type 2.
+       < 0: Do not accept routing header.
+
+       Default: 0
+
 autoconf - BOOLEAN
        Autoconfigure addresses using Prefix Information in Router 
        Advertisements.

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index f8241130f5eade5232b3fb5e4a4c8984767d9a59..713eb5eaa81f2e030dd634055568373c8a812182 100644 (file)
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -177,6 +177,7 @@ struct ipv6_devconf {
 #endif
 #endif
        __s32           proxy_ndp;
+       __s32           accept_source_route;
        void            *sysctl;
 };
 
@@ -205,6 +206,8 @@ enum {
        DEVCONF_RTR_PROBE_INTERVAL,
        DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN,
        DEVCONF_PROXY_NDP,
+       __DEVCONF_OPTIMISTIC_DAD,
+       DEVCONF_ACCEPT_SOURCE_ROUTE,
        DEVCONF_MAX
 };
 

diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 81480e6134674c19030f48336ca718ab40fbb100..6f34622997da2bc3acaf9bdd795d77645908f6d8 100644 (file)
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -570,6 +570,7 @@ enum {
        NET_IPV6_RTR_PROBE_INTERVAL=21,
        NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
        NET_IPV6_PROXY_NDP=23,
+       NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
        __NET_IPV6_MAX
 };
 

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 58cb669a27cabcb4c93ed8d5d3a337eaa7682aad..f5af4ca804ed508878e2a50806811eb8fb603eac 100644 (file)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -173,6 +173,7 @@ struct ipv6_devconf ipv6_devconf __read_mostly = {
 #endif
 #endif
        .proxy_ndp              = 0,
+       .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 };
 
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -204,6 +205,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 #endif
 #endif
        .proxy_ndp              = 0,
+       .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 };
 
 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -3400,6 +3402,7 @@ static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
 #endif
        array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
+       array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
 }
 
 static inline size_t inet6_if_nlmsg_size(void)
@@ -3919,6 +3922,14 @@ static struct addrconf_sysctl_table
                        .mode           =       0644,
                        .proc_handler   =       &proc_dointvec,
                },
+               {
+                       .ctl_name       =       NET_IPV6_ACCEPT_SOURCE_ROUTE,
+                       .procname       =       "accept_source_route",
+                       .data           =       &ipv6_devconf.accept_source_route,
+                       .maxlen         =       sizeof(int),
+                       .mode           =       0644,
+                       .proc_handler   =       &proc_dointvec,
+               },
                {
                        .ctl_name       =       0,      /* sentinel */
                }

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 0711f92d6a1238961ff0f7f4acd69e5e0268cd82..5fd7cf97d95d7148ebac30ef682c289338ac620f 100644 (file)
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -363,10 +363,27 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
        struct inet6_skb_parm *opt = IP6CB(skb);
        struct in6_addr *addr = NULL;
        struct in6_addr daddr;
+       struct inet6_dev *idev;
        int n, i;
-
        struct ipv6_rt_hdr *hdr;
        struct rt0_hdr *rthdr;
+       int accept_source_route = ipv6_devconf.accept_source_route;
+
+       if (accept_source_route < 0 ||
+           ((idev = in6_dev_get(skb->dev)) == NULL)) {
+               kfree_skb(skb);
+               return -1;
+       }
+       if (idev->cnf.accept_source_route < 0) {
+               in6_dev_put(idev);
+               kfree_skb(skb);
+               return -1;
+       }
+
+       if (accept_source_route > idev->cnf.accept_source_route)
+               accept_source_route = idev->cnf.accept_source_route;
+
+       in6_dev_put(idev);
 
        if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
            !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
@@ -378,6 +395,22 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
        hdr = (struct ipv6_rt_hdr *) skb->h.raw;
 
+       switch (hdr->type) {
+#ifdef CONFIG_IPV6_MIP6
+               break;
+#endif
+       case IPV6_SRCRT_TYPE_0:
+               if (accept_source_route > 0)
+                       break;
+               kfree_skb(skb);
+               return -1;
+       default:
+               IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                IPSTATS_MIB_INHDRERRORS);
+               icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
+               return -1;
+       }
+
        if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||
            skb->pkt_type != PACKET_HOST) {
                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -435,11 +468,6 @@ looped_back:
                }
                break;
 #endif
-       default:
-               IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
-                                IPSTATS_MIB_INHDRERRORS);
-               icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
-               return -1;
        }
 
        /*