Re: [PATCH net] ipv6: sr: fix TLVs not being copied using setsockopt

Re: [PATCH net] ipv6: sr: fix TLVs not being copied using setsockopt

[Mathieu Xhonneux]

Just realized I messed up the justification about sr_has_hmac. The
branch will be taken, but its execution will not complete since the
TLV's len and type fields aren't copied, hence seg6_get_tlv_hmac will
fail, and the HMAC will not be computed.

2018-01-07 17:12 GMT+00:00 Mathieu Xhonneux <m.xhonneux@gmail.com>:
> Function ipv6_push_rthdr4 allows to add an IPv6 Segment Routing Header
> to a socket through setsockopt, but the current implementation doesn't
> copy possible TLVs at the end of the SRH (i.e., the following branch
> if (sr_has_hmac(sr_phdr)) will never be taken as no HMAC TLV is copied).
>
> This commit adds a memcpy in case TLVs have been appended to the SRH.
>
> Fixes: a149e7c7ce812561f0fdc7a86ddc42f294e5eb3e ("ipv6: sr: add
> support for SRH injection through setsockopt")
> Acked-by: David Lebrun <dlebrun@google.com>
> Signed-off-by: Mathieu Xhonneux <m.xhonneux@gmail.com>
> ---
>  net/ipv6/exthdrs.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 83bd75713535..bc68eb661970 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -925,6 +925,15 @@ static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
>         sr_phdr->segments[0] = **addr_p;
>         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
>
> +       if (sr_ihdr->hdrlen > hops * 2) {
> +               int tlvs_offset, tlvs_length;
> +
> +               tlvs_offset = (1 + hops * 2) << 3;
> +               tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
> +               memcpy((char *)sr_phdr + tlvs_offset,
> +                      (char *)sr_ihdr + tlvs_offset, tlvs_length);
> +       }
> +
>  #ifdef CONFIG_IPV6_SEG6_HMAC
>         if (sr_has_hmac(sr_phdr)) {
>                 struct net *net = NULL;
> --
> 2.15.1
>

[PATCH net] ipv6: sr: fix TLVs not being copied using setsockopt

[Mathieu Xhonneux]

Function ipv6_push_rthdr4 allows to add an IPv6 Segment Routing Header
to a socket through setsockopt, but the current implementation doesn't
copy possible TLVs at the end of the SRH (i.e., the following branch
if (sr_has_hmac(sr_phdr)) will never be taken as no HMAC TLV is copied).

This commit adds a memcpy in case TLVs have been appended to the SRH.

Fixes: a149e7c7ce812561f0fdc7a86ddc42f294e5eb3e ("ipv6: sr: add
support for SRH injection through setsockopt")
Acked-by: David Lebrun <dlebrun@google.com>
Signed-off-by: Mathieu Xhonneux <m.xhonneux@gmail.com>
---
 net/ipv6/exthdrs.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 83bd75713535..bc68eb661970 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -925,6 +925,15 @@ static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 	sr_phdr->segments[0] = **addr_p;
 	*addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
 
+	if (sr_ihdr->hdrlen > hops * 2) {
+		int tlvs_offset, tlvs_length;
+
+		tlvs_offset = (1 + hops * 2) << 3;
+		tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
+		memcpy((char *)sr_phdr + tlvs_offset,
+		       (char *)sr_ihdr + tlvs_offset, tlvs_length);
+	}
+
 #ifdef CONFIG_IPV6_SEG6_HMAC
 	if (sr_has_hmac(sr_phdr)) {
 		struct net *net = NULL;
-- 
2.15.1

Re: [PATCH net] ipv6: sr: fix TLVs not being copied using setsockopt

[David Miller]

From: Mathieu Xhonneux <m.xhonneux@gmail.com>
Date: Sun, 7 Jan 2018 16:55:22 +0000

> Just realized I messed up the justification about sr_has_hmac. The
> branch will be taken, but its execution will not complete since the
> TLV's len and type fields aren't copied, hence seg6_get_tlv_hmac will
> fail, and the HMAC will not be computed.

Mathieu, please repost this with the commit message fixed up.

Thank you.