From patchwork Fri Jul 16 10:38:44 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnaud Ebalard X-Patchwork-Id: 59092 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id EA7D1B6F0C for ; Fri, 16 Jul 2010 20:38:49 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965017Ab0GPKih (ORCPT ); Fri, 16 Jul 2010 06:38:37 -0400 Received: from copper.chdir.org ([88.191.97.87]:56805 "EHLO copper.chdir.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964971Ab0GPKig (ORCPT ); Fri, 16 Jul 2010 06:38:36 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=natisbad.org; s=mail; h=From:To:Cc:Subject:Date:Message-ID: MIME-Version:Content-Type; bh=zuHq9dBU2nd6zdQyiAZx27B5vuH0ZylfJY GlS7pJnCo=; b=hyYHkJOLL6jera2Ot0TTKl2Lr2XPUoIFXPJqdkLkBoY33ENQgp 6BcS6kD87TadHOyItexpWOscwHeYymMmKVMgpWQE1bhqRFqmNMXF+NGRNvh/TRgz HR7iTtNOeQiWuzJaSk+AanBuDPydSDJVWqqVqtA63jgTdmH5RMH0gima8= Received: from [2001:7a8:78df:2:20d:93ff:fe55:8f79] (helo=small.ssi.corp) by copper.chdir.org with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1OZiJK-0005o3-RL; Fri, 16 Jul 2010 12:38:31 +0200 X-Hashcash: 1:20:100716:davem@davemloft.net::dORK3MKepvjok20S:00000000000000000000000000000000000000000030yM X-Hashcash: 1:20:100716:yoshfuji@linux-ipv6.org::hEAYIZzp3+rR4DUX:000000000000000000000000000000000000009d8I X-Hashcash: 1:20:100716:netdev@vger.kernel.org::+luhSyBKSQnEruFr:0000000000000000000000000000000000000000U1z From: arno@natisbad.org (Arnaud Ebalard) To: "David S. Miller" , Hideaki YOSHIFUJI Cc: netdev@vger.kernel.org Subject: [PATCH] IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input()) X-PGP-Key-URL: http://natisbad.org/arno@natisbad.org.asc X-Fingerprint: D3A5 B68A 839B 38A5 815A 781B B77C 0748 A7AE 341B Date: Fri, 16 Jul 2010 12:38:44 +0200 Message-ID: <87aapr7lu3.fsf@small.ssi.corp> User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/23.1.50 (gnu/linux) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi, The input handler for Type 2 Routing Header (mip6_rthdr_input()) checks if the CoA in the packet matches the CoA in the XFRM state. Current check is buggy: it compares the adddress in the Type 2 Routing Header, i.e. the HoA, against the expected CoA in the state. The comparison should be made against the address in the destination field of the IPv6 header. The bug remained unnoticed because the main (and possibly only current) user of the code (UMIP MIPv6 Daemon) initializes the XFRM state with the unspecified address, i.e. explicitly allows everything. Yoshifuji-san, can you ack that one? Cheers, a+ Signed-off-by: Arnaud Ebalard --- net/ipv6/mip6.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c index 2794b60..d6e9599 100644 --- a/net/ipv6/mip6.c +++ b/net/ipv6/mip6.c @@ -347,11 +347,12 @@ static const struct xfrm_type mip6_destopt_type = static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb) { + struct ipv6hdr *iph = ipv6_hdr(skb); struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data; int err = rt2->rt_hdr.nexthdr; spin_lock(&x->lock); - if (!ipv6_addr_equal(&rt2->addr, (struct in6_addr *)x->coaddr) && + if (!ipv6_addr_equal(&iph->daddr, (struct in6_addr *)x->coaddr) && !ipv6_addr_any((struct in6_addr *)x->coaddr)) err = -ENOENT; spin_unlock(&x->lock);