[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 16 Jan 2013 15:03:02 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel handling of IPv6 temporary
addresses
Hello,
+-- On Wed, 14 Nov 2012, Greg KH wrote --+
| > [183.793393] ipv6_create_tempaddr(): retry temporary address
| > regeneration [183.793405] ipv6_create_tempaddr(): retry temporary
| > address regeneration [183.793411] ipv6_create_tempaddr(): retry
| > temporary address regeneration
| >
| > After 'regen_max_retry' is reached the kernel completely disables
| > temporary address generation for that interface.
| >
| > [183.793413] ipv6_create_tempaddr(): regeneration time exceeded -
| > disabled temporary address support
I was trying to reproduce this with the `thc-ipv6-2.0' toolkit, by sending
ICMPv6 RA requests. Kernel logs following message, not the above ones
...kernel: ICMPv6 RA: ndisc_router_discovery() failed to add default route
| > A malicious LAN user can send a limited amount of RA prefixes and thus
| > disable IPv6 temporary address creation for any Linux host.
is there a RA parameter I need to pass to reproduce above message from
ipv6_create_tempaddr() ?
| >
| > The kernel should at least differentiate between the two cases of
| > reaching max_addresses and being unable to create new addresses, due to
| > DAD conflicts for example.
Does this patch seem right?
===
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 420e563..742d66a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1046,12 +1046,19 @@ retry:
if (ifp->flags & IFA_F_OPTIMISTIC)
addr_flags |= IFA_F_OPTIMISTIC;
- ift = !max_addresses ||
- ipv6_count_addresses(idev) < max_addresses ?
- ipv6_add_addr(idev, &addr, tmp_plen,
- ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
- addr_flags) : NULL;
- if (!ift || IS_ERR(ift)) {
+ ift = NULL;
+ if (!max_addresses || ipv6_count_addresses(idev) < max_addresses)
+ ipv6_add_addr(idev, &addr, tmp_plen,
+ ipv6_addr_type(&addr) & IPV6_ADDR_SCOPE_MASK,
+ addr_flags);
+ if (!ift) {
+ in6_ifa_put(ifp);
+ in6_dev_put(idev);
+ pr_info("%s: ipv6 temporary address upper limit reached\n", __func__);
+ ret = -1;
+ goto out;
+ }
+ else if (IS_ERR(ift)) {
in6_ifa_put(ifp);
in6_dev_put(idev);
pr_info("%s: retry temporary address regeneration\n", __func__);
===
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
DB7A 84C5 D3F9 7CD1 B5EB C939 D048 7860 3655 602B
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
