Commit 076b8cad authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Jakub Kicinski
Browse files

ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim 



Commit 47d3d7ac ("ipv6: Implement limits on Hop-by-Hop and
Destination options") added net.ipv6.max_{hbh,dst}_opts_{cnt,len}
and applied them in ip6_parse_tlv(), the generic TLV walker
invoked from ipv6_destopt_rcv() and ipv6_parse_hopopts().

ip6_tnl_parse_tlv_enc_lim() does not go through ip6_parse_tlv();
it has its own hand-rolled TLV scanner inside its NEXTHDR_DEST
branch which looks for IPV6_TLV_TNL_ENCAP_LIMIT. That inner
loop is bounded only by optlen, which can be up to 2048 bytes.
Stuffing the Destination Options header with 2046 Pad1 (type=0)
entries advances the scanner a single byte at a time, yielding
~2000 TLV iterations per extension header.

Reusing max_dst_opts_cnt to bound the TLV iterations, matching
the semantics from 47d3d7ac, would require duplicating
ip6_parse_tlv() to also validate Pad1/PadN payload. It would
also mandate enforcing max_dst_opts_len, since otherwise an
attacker shifts the axis to few options with a giant PadN and
recovers the original DoS. Allowing up to 8 options before the
tunnel encapsulation limit TLV is liberal enough; in practice
encap limit is the first TLV. Thus, go with a hard-coded limit
IP6_TUNNEL_MAX_DEST_TLVS (8).

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Reviewed-by: default avatarJustin Iurman <justin.iurman@gmail.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d293ca71

net/ipv6/ip6_tunnel.c

+6 −0
Original line number Diff line number Diff line
@@ -62,6 +62,8 @@ MODULE_LICENSE("GPL"); 
MODULE_ALIAS_RTNL_LINK("ip6tnl");

MODULE_ALIAS_NETDEV("ip6tnl0");



#define IP6_TUNNEL_MAX_DEST_TLVS    8



#define IP6_TUNNEL_HASH_SIZE_SHIFT  5

#define IP6_TUNNEL_HASH_SIZE (1 << IP6_TUNNEL_HASH_SIZE_SHIFT)
@@ -425,11 +427,15 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) 
				break;

		}

		if (nexthdr == NEXTHDR_DEST) {

			int tlv_cnt = 0;

			u16 i = 2;



			while (1) {

				struct ipv6_tlv_tnl_enc_lim *tel;



				if (unlikely(tlv_cnt++ >= IP6_TUNNEL_MAX_DEST_TLVS))

					break;



				/* No more room for encapsulation limit */

				if (i + sizeof(*tel) > optlen)

					break;