Messages in this thread | | | Date | Thu, 12 Apr 2012 16:00:40 -0400 (EDT) | Subject | Re: [PATCH] net/ipv6/exthdrs.c et al: Optional strict PadN option checking | From | David Miller <> |
| |
From: Eldad Zack <eldad@fogrefinery.com> Date: Sat, 7 Apr 2012 17:16:14 +0200
> Added strict checking of PadN. PadN can be used to increase header > size and thus push the protocol header into the 2nd fragment. > > PadN is used to align the options within the Hop-by-Hop or > Destination Options header to 64-bit boundaries. The maximum valid > size is thus 7 bytes. > RFC 4942 recommends to actively check the "payload" itself and > ensure that it contains only zeroes. > > See also RFC 4942 section 2.1.9.5. > > Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
I think you should do away with the sysctl and always perform these checks.
At the very leat, the optlen > 7 check should always be performed. And frankly the pad byte being zero check makes sense to do all the time as far as I can tell too.
| |