<div dir="ltr">Fernando, muchas gracias por la info.<div>Abrazo</div><div>Julio César</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/8/15 Fernando Gont <span dir="ltr"><<a href="mailto:fernando@gont.com.ar" target="_blank">fernando@gont.com.ar</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">FYI. Parche para Linux :-)<br>
<br>
Tomó un dia.<br>
<br>
Saludos,<br>
Fernando<br>
<br>
<br>
<br>
<br>
-------- Original Message --------<br>
Subject: Re: Fwd: RFC 6980 on Security Implications of IPv6<br>
Fragmentation with IPv6 Neighbor Discovery<br>
Date: Thu, 15 Aug 2013 01:06:17 +0200<br>
From: Hannes Frederic Sowa <<a href="mailto:hannes@stressinduktion.org">hannes@stressinduktion.org</a>><br>
To: Fernando Gont <<a href="mailto:fernando@gont.com.ar">fernando@gont.com.ar</a>><br>
CC: netdev <<a href="mailto:netdev@vger.kernel.org">netdev@vger.kernel.org</a>><br>
<br>
On Wed, Aug 14, 2013 at 05:19:13AM -0300, Fernando Gont wrote:<br>
> Folks,<br>
><br>
> FYI. -- this is an important piece when it comes to First Hop (i.e.,<br>
> "local link") Security.<br>
<br>
Thanks for the heads-up, Fernando!<br>
<br>
I sketched up a patch to protect the receiving side. I still don't know if I<br>
should make this behaviour default or configurable via a sysctl knob. I<br>
really<br>
don't want to break existing installations.<br>
<br>
As an extra plus, we now discard packets with nested fragment headers at<br>
once.<br>
Those packets should never have been accepted.<br>
<br>
Thanks,<br>
<br>
Hannes<br>
<br>
<br>
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h<br>
index 77a4784..9ac5047 100644<br>
--- a/include/linux/ipv6.h<br>
+++ b/include/linux/ipv6.h<br>
@@ -103,6 +103,7 @@ struct inet6_skb_parm {<br>
#define IP6SKB_FORWARDED 2<br>
#define IP6SKB_REROUTED 4<br>
#define IP6SKB_ROUTERALERT 8<br>
+#define IP6SKB_FRAGMENTED 16<br>
};<br>
<br>
#define IP6CB(skb) ((struct inet6_skb_parm*)((skb)->cb))<br>
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c<br>
index 79aa965..5c91616 100644<br>
--- a/net/ipv6/ndisc.c<br>
+++ b/net/ipv6/ndisc.c<br>
@@ -1524,6 +1524,9 @@ int ndisc_rcv(struct sk_buff *skb)<br>
if (skb_linearize(skb))<br>
return 0;<br>
<br>
+ if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)<br>
+ return 0;<br>
+<br>
msg = (struct nd_msg *)skb_transport_header(skb);<br>
<br>
__skb_push(skb, skb->data - skb_transport_header(skb));<br>
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c<br>
index 790d9f4..1aeb473 100644<br>
--- a/net/ipv6/reassembly.c<br>
+++ b/net/ipv6/reassembly.c<br>
@@ -490,6 +490,7 @@ static int ip6_frag_reasm(struct frag_queue *fq,<br>
struct sk_buff *prev,<br>
ipv6_hdr(head)->payload_len = htons(payload_len);<br>
ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);<br>
IP6CB(head)->nhoff = nhoff;<br>
+ IP6CB(head)->flags |= IP6SKB_FRAGMENTED;<br>
<br>
/* Yes, and fold redundant checksum back. 8) */<br>
if (head->ip_summed == CHECKSUM_COMPLETE)<br>
@@ -524,6 +525,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)<br>
struct net *net = dev_net(skb_dst(skb)->dev);<br>
int evicted;<br>
<br>
+ if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)<br>
+ goto fail_hdr;<br>
+<br>
IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);<br>
<br>
/* Jumbo payload inhibits frag. header */<br>
@@ -544,6 +548,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)<br>
ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);<br>
<br>
IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);<br>
+ IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;<br>
return 1;<br>
}<br>
<br>
<br>
<br>
--<br>
Fernando Gont<br>
e-mail: <a href="mailto:fernando@gont.com.ar">fernando@gont.com.ar</a> || <a href="mailto:fgont@si6networks.com">fgont@si6networks.com</a><br>
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
LACTF mailing list<br>
<a href="mailto:LACTF@lacnic.net">LACTF@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lactf" target="_blank">https://mail.lacnic.net/mailman/listinfo/lactf</a><br>
Cancelar suscripcion: <a href="mailto:lactf-unsubscribe@lacnic.net">lactf-unsubscribe@lacnic.net</a></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div>-</div><div><div>Cualquier consulta a disposición</div>
<div><br></div><div>Saludos cordiales</div><div><br></div><div><div style="font-size:13.333333969116211px;background-color:rgb(255,255,255)"><p style="font-family:arial,sans-serif;margin:0px"></p><div style="font-family:arial;font-size:small">
<b style="font-family:arial,sans-serif;font-size:13.333333969116211px"><span style="font-size:10pt;font-family:Arial,sans-serif">Julio Cesar Balderrama</span></b></div><div dir="ltr" style="font-size:small"><div><p style="font-family:arial;margin:0px">
<span style="font-family:Arial,sans-serif;font-size:10pt">C</span><b style="font-family:Arial,sans-serif;font-size:10pt"><font color="#ff0000">|</font></b><span style="font-family:Arial,sans-serif;font-size:10pt">CISO, CISM, BCMSLA, ISMSLA</span></p>
<p style="font-family:arial;margin:0px"><font face="arial, sans-serif">Security & Business Continuity Consultant</font></p><p style="font-family:arial,sans-serif;font-size:13.333333969116211px;margin:0px"><span style="font-size:10pt">Alicia M. de Justo 1120, 3P, A306 </span></p>
<p style="font-family:arial,sans-serif;font-size:13.333333969116211px;margin:0px"><span style="font-size:10pt;font-family:Arial,sans-serif">C.A.B.A., C1107AAX - Argentina<u></u><u></u></span></p><p style="font-size:13.333333969116211px;margin:0px">
<span style="font-size:10pt"><font face="arial, sans-serif">M</font></span><span style="font-family:Arial,sans-serif;font-size:10pt">: (+54 911) 3271-2639</span></p></div><p style="font-family:arial,sans-serif;margin:0px;font-size:13.333333969116211px">
<span style="font-size:10pt;font-family:Arial,sans-serif"><span lang="EN-US">E: <a href="mailto:juliocesar@balderrama.com.ar" target="_blank">juliocesar@balderrama.com.ar</a></span></span><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
<div style="font-family:arial,sans-serif;font-size:13.333333969116211px">Profile: <a href="http://ar.linkedin.com/in/juliocesarbalderrama" target="_blank">http://ar.linkedin.com/in/juliocesarbalderrama</a></div></div><p style="font-family:arial,sans-serif">
</p></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13.333333969116211px;background-color:rgb(255,255,255)"><p style="margin:0px"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,153,0)">P: No imprima este documento, si realmente no lo necesita</span><span style="font-size:10pt;font-family:'Times New Roman',serif"><u></u><u></u></span></p>
</div><div align="center" style="margin:0px;color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333333969116211px;background-color:rgb(255,255,255);text-align:center"><span style="font-size:12pt;font-family:'Times New Roman',serif"><hr size="2" width="100%" align="center">
</span></div><p style="margin:0px;color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333333969116211px;background-color:rgb(255,255,255)"></p><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13.333333969116211px;background-color:rgb(255,255,255)">
<span style="font-size:7.5pt;font-family:Arial,sans-serif;color:gray">Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.<br>
<br></span><span lang="EN-US" style="font-size:7.5pt;font-family:Arial,sans-serif;color:gray">The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.<br>
<br></span></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13.333333969116211px;background-color:rgb(255,255,255)"><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:gray">Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição</span></div>
</div><div><span style="border-collapse:collapse"><div style="font-family:arial;font-size:small;font-weight:normal"><p></p></div></span></div></div></div>
</div>