Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <alpine.LFD.2.03.1301161449530.18563@erqung.pbz>
Date: Wed, 16 Jan 2013 15:03:02 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel handling of IPv6 temporary
 addresses


  Hello,

+-- On Wed, 14 Nov 2012, Greg KH wrote --+
| > [183.793393] ipv6_create_tempaddr(): retry temporary address
| > regeneration [183.793405] ipv6_create_tempaddr(): retry temporary
| > address regeneration [183.793411] ipv6_create_tempaddr(): retry
| > temporary address regeneration
| > 
| > After 'regen_max_retry' is reached the kernel completely disables
| > temporary address generation for that interface.
| > 
| > [183.793413] ipv6_create_tempaddr(): regeneration time exceeded -
| > disabled temporary address support

  I was trying to reproduce this with the `thc-ipv6-2.0' toolkit, by sending 
ICMPv6 RA requests. Kernel logs following message, not the above ones

...kernel: ICMPv6 RA: ndisc_router_discovery() failed to add default route

| > A malicious LAN user can send a limited amount of RA prefixes and thus
| > disable IPv6 temporary address creation for any Linux host.

  is there a RA parameter I need to pass to reproduce above message from 
ipv6_create_tempaddr() ?

| > 
| > The kernel should at least differentiate between the two cases of
| > reaching max_addresses and being unable to create new addresses, due to
| > DAD conflicts for example.

  Does this patch seem right?

===
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 420e563..742d66a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1046,12 +1046,19 @@ retry:
 	if (ifp->flags & IFA_F_OPTIMISTIC)
 		addr_flags |= IFA_F_OPTIMISTIC;
 
-	ift = !max_addresses ||
-	      ipv6_count_addresses(idev) < max_addresses ?
-		ipv6_add_addr(idev, &addr, tmp_plen,
-			      ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
-			      addr_flags) : NULL;
-	if (!ift || IS_ERR(ift)) {
+    ift = NULL;
+    if (!max_addresses || ipv6_count_addresses(idev) < max_addresses)
+        ipv6_add_addr(idev, &addr, tmp_plen,
+                        ipv6_addr_type(&addr) & IPV6_ADDR_SCOPE_MASK,
+                        addr_flags);
+    if (!ift) {
+        in6_ifa_put(ifp);
+        in6_dev_put(idev);
+        pr_info("%s: ipv6 temporary address upper limit reached\n", __func__);
+        ret = -1;
+        goto out;
+    }
+    else if (IS_ERR(ift)) {
 		in6_ifa_put(ifp);
 		in6_dev_put(idev);
 		pr_info("%s: retry temporary address regeneration\n", __func__);
===


Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
DB7A 84C5 D3F9 7CD1 B5EB  C939 D048 7860 3655 602B

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.