Re: [PATCH RESEND] ipv6: return with appropriate error code when sending RH0 using setsockopt()

[Brian Haley <brian.haley@hp.com>]

Shan Wei wrote:
> Brian Haley 写道:
>> Shan Wei wrote:
> 
> ...snip...
> 
>> There's actually another bug here and in the sendmsg() path in that you
>> can set the hdrlen and segments_left fields to be invalid (according to
>> RFC3775), as long as the math works out (segments * 2 == length).
>> Segments_left should always be 1 and hdrlen 2 for a Type2 routing
>> header.  The packet should be dropped at the destination, but we
>> probably shouldn't send it.  I can send a patch for that later.
>>
> I check the RFC3775. May be the following patch is good to you.
> 
> Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
> ---
>  net/ipv6/datagram.c      |    8 ++++++--
>  net/ipv6/ipv6_sockglue.c |    7 +++++--
>  2 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
> index 410046a..cfd499a 100644
> --- a/net/ipv6/datagram.c
> +++ b/net/ipv6/datagram.c
> @@ -675,8 +675,12 @@ int datagram_send_ctl(struct net *net,
>  				goto exit_f;
>  			}
>  
> -			/* segments left must also match */
> -			if ((rthdr->hdrlen >> 1) != rthdr->segments_left) {
> +			/* Per RFC3775, for a type 2 routing header,
> +			 * the Hdr Ext Len MUST be 2 and the Segments Left
> +			 * MUST be 1.
> +			 */
> +			if ((rthdr->hdrlen != 2) &&
> +			    (rthdr->segments_left != 1)) {
>  				err = -EINVAL;
>  				goto exit_f;
>  			}
> diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
> index 4e5eac3..b967965 100644
> --- a/net/ipv6/ipv6_sockglue.c
> +++ b/net/ipv6/ipv6_sockglue.c
> @@ -377,8 +377,11 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
>  				goto sticky_done;
>  			}
>  
> -			if ((rthdr->hdrlen & 1) ||
> -			    (rthdr->hdrlen >> 1) != rthdr->segments_left)
> +			/* Per RFC3775, for a type 2 routing header,
> +			 * the Hdr Ext Len MUST be 2 and the Segments Left
> +			 * MUST be 1.
> +			 */
> +			if ((rthdr->hdrlen != 2) && (rthdr->segments_left != 1))
>  				goto sticky_done;
>  		}

I think these checks need to be in the Type 2 specific code since if we
add support for Type 7, for example, then we'd have to change this
again.  I"'ll send something out soon.

-Brian