[PATCH] Cipso: cipso_v4_optptr enter infinite loop

[PATCH] Cipso: cipso_v4_optptr enter infinite loop

[Yujuan Qi]

From: "yujuan.qi" <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>

in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.

Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue

Signed-off-by: yujuan.qi <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>
---
 net/ipv4/cipso_ipv4.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index ae20616..0d1e07d 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
 	int taglen;
 
 	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
-		if (optptr[0] == IPOPT_CIPSO)
+		switch (optptr[0]) {
+		case IPOPT_CIPSO:
 			return optptr;
-		taglen = optptr[1];
+		case IPOPT_END:
+			return NULL;
+		case IPOPT_NOOP:
+			taglen = 1;
+			break;
+		default:
+			taglen = optptr[1];
+		}
 		optlen -= taglen;
 		optptr += taglen;
 	}
-- 
1.9.1

Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop

[Paul Moore]

On Sun, Jul 30, 2017 at 11:23 PM, Yujuan Qi <yujuan.qi@mediatek.com> wrote:
> From: "yujuan.qi" <yujuan.qi@mediatek.com>
>
> in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
>
> Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
>
> Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
> ---
>  net/ipv4/cipso_ipv4.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)

Considering I gave you the code below I should probably ack it, right? ;)

Acked-by: Paul Moore <paul@paul-moore.com>

> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index ae20616..0d1e07d 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
>         int taglen;
>
>         for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
> -               if (optptr[0] == IPOPT_CIPSO)
> +               switch (optptr[0]) {
> +               case IPOPT_CIPSO:
>                         return optptr;
> -               taglen = optptr[1];
> +               case IPOPT_END:
> +                       return NULL;
> +               case IPOPT_NOOP:
> +                       taglen = 1;
> +                       break;
> +               default:
> +                       taglen = optptr[1];
> +               }
>                 optlen -= taglen;
>                 optptr += taglen;
>         }

-- 
paul moore
security @ redhat

Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop

[yujuan.qi]

Hi
On Mon, 2017-07-31 at 16:13 -0400, Paul Moore wrote:
> On Sun, Jul 30, 2017 at 11:23 PM, Yujuan Qi <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org> wrote:
> > From: "yujuan.qi" <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>
> >
> > in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
> >
> > Test: receive a packet which the ip length > 20 and t he first byte of ip option is 0, produce this issue
> >
> > Signed-off-by: yujuan.qi <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>
> > ---
> >  net/ipv4/cipso_ipv4.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> Considering I gave you the code below I should probably ack it, right? ;)
> 
> Acked-by: Paul Moore <paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org>

Yes! Thanks for your suggestions!

> > diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> > index ae20616..0d1e07d 100644
> > --- a/net/ipv4/cipso_ipv4.c
> > +++ b/net/ipv4/cipso_ipv4.c
> > @@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
> >         int taglen;
> >
> >         for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
> > -               if (optptr[0] == IPOPT_CIPSO)
> > +               switch (optptr[0]) {
> > +               case IPOPT_CIPSO:
> >                         return optptr;
> > -               taglen = optptr[1];
> > +               case IPOPT_END:
> > +                       return NULL;
> > +               case IPOPT_NOOP:
> > +                       taglen = 1;
> > +                       break;
> > +               default:
> > +                       taglen = optptr[1];
> > +               }
> >                 optlen -= taglen;
> >                 optptr += taglen;
> >         }
> 

Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop

[David Miller]

From: Yujuan Qi <yujuan.qi@mediatek.com>
Date: Mon, 31 Jul 2017 11:23:01 +0800

> From: "yujuan.qi" <yujuan.qi@mediatek.com>
> 
> in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
> 
> Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
> 
> Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>

Applied, thanks.

Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop

[Paul Moore]

On Fri, Jul 28, 2017 at 7:30 AM, Yujuan Qi <yujuan.qi@mediatek.com> wrote:
> From: "yujuan.qi" <yujuan.qi@mediatek.com>
>
> in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
>
> Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
>
> Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
> ---
>  net/ipv4/cipso_ipv4.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index ae20616..b3d97c7 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1528,6 +1528,8 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
>                 taglen = optptr[1];
>                 optlen -= taglen;
>                 optptr += taglen;
> +               if (!taglen)
> +                       break;
>         }
>
>         return NULL;

Thanks for catching this and submitting a patch.  Unfortunately
checking taglen/optptr[1] isn't going to help with the NOP and EOL
options as they are single byte options.  I think a for-loop like the
following, or something similar, is probably the better solution:

  for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
         switch (optptr[0]) {
         case IPOPT_CIPSO:
                 return optptr;
         case IPOPT_END:
                 return NULL;
         case IPOPT_NOOP:
                 taglen = 1;
                 break;
         default:
                 taglen = optptr[1];
         }
         optlen -= taglen;
         optptr += taglen;
  }

-- 
paul moore
security @ redhat