[PATCH] net/ipv4: Timestamp option cannot overflow with prespecified addresses

[PATCH] net/ipv4: Timestamp option cannot overflow with prespecified addresses

[David Ward]

When a router forwards a packet that contains the IPv4 timestamp option,
if there is no space left in the option for the router to add its own
timestamp, then the router increments the Overflow value in the option.

However, if the addresses of the routers are prespecified in the option,
then the overflow condition cannot happen: the option is structured so
that each prespecified router has a place to write its timestamp. Other
routers do not add a timestamp, so there will never be a lack of space.

This fix ensures that the Overflow value in the IPv4 timestamp option is
not incremented when the addresses of the routers are prespecified, even
if the Pointer value is greater than the Length value.

Signed-off-by: David Ward <david.ward@ll.mit.edu>
---
 net/ipv4/ip_options.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index f6289bf..310a364 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -423,7 +423,7 @@ int ip_options_compile(struct net *net,
 					put_unaligned_be32(midtime, timeptr);
 					opt->is_changed = 1;
 				}
-			} else {
+			} else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) {
 				unsigned int overflow = optptr[3]>>4;
 				if (overflow == 15) {
 					pp_ptr = optptr + 3;
-- 
1.7.1

Re: [PATCH] net/ipv4: Timestamp option cannot overflow with prespecified addresses

[David Miller]

From: David Ward <david.ward@ll.mit.edu>
Date: Tue, 5 Mar 2013 22:06:32 -0500

> When a router forwards a packet that contains the IPv4 timestamp option,
> if there is no space left in the option for the router to add its own
> timestamp, then the router increments the Overflow value in the option.
> 
> However, if the addresses of the routers are prespecified in the option,
> then the overflow condition cannot happen: the option is structured so
> that each prespecified router has a place to write its timestamp. Other
> routers do not add a timestamp, so there will never be a lack of space.
> 
> This fix ensures that the Overflow value in the IPv4 timestamp option is
> not incremented when the addresses of the routers are prespecified, even
> if the Pointer value is greater than the Length value.
> 
> Signed-off-by: David Ward <david.ward@ll.mit.edu>

Applied, thanks for fixing this.