[Glibc-bsd-commits] r1920 - in trunk/kfreebsd-6/debian: . patches

[Aurelien Jarno]

Author: aurel32
Date: 2007-05-03 14:14:41 +0000 (Thu, 03 May 2007)
New Revision: 1920

Added:
   trunk/kfreebsd-6/debian/patches/000_ipv6.diff
Modified:
   trunk/kfreebsd-6/debian/changelog
Log:
  * Fix a possible DoS using IPv6 Routing Header 0 (FreeBSD-SA-07:03.ipv6
    / CVE-2007-2242).



Modified: trunk/kfreebsd-6/debian/changelog
===================================================================
--- trunk/kfreebsd-6/debian/changelog	2007-04-27 06:39:06 UTC (rev 1919)
+++ trunk/kfreebsd-6/debian/changelog	2007-05-03 14:14:41 UTC (rev 1920)
@@ -1,3 +1,10 @@
+kfreebsd-6 (6.2-2) unreleased; urgency=low
+
+  * Fix a possible DoS using IPv6 Routing Header 0 (FreeBSD-SA-07:03.ipv6
+    / CVE-2007-2242).
+
+ -- Aurelien Jarno <aurel32 at debian.org>  Thu, 03 May 2007 16:05:58 +0200
+
 kfreebsd-6 (6.2-1) unreleased; urgency=low
 
   [ Petr Salinger ]

Added: trunk/kfreebsd-6/debian/patches/000_ipv6.diff
===================================================================
--- trunk/kfreebsd-6/debian/patches/000_ipv6.diff	2007-04-27 06:39:06 UTC (rev 1919)
+++ trunk/kfreebsd-6/debian/patches/000_ipv6.diff	2007-05-03 14:14:41 UTC (rev 1920)
@@ -0,0 +1,66 @@
+Index: sys/netinet6/in6.h
+===================================================================
+RCS file: /sources/FreeBSD-CVS/src/sys/netinet6/in6.h,v
+retrieving revision 1.36.2.7
+diff -u -r1.36.2.7 in6.h
+--- sys/netinet6/in6.h	20 Aug 2006 19:28:43 -0000	1.36.2.7
++++ sys/netinet6/in6.h	24 Apr 2007 03:11:29 -0000
+@@ -574,5 +574,6 @@
+ #define IPV6CTL_STEALTH		45
+-#define IPV6CTL_MAXID		46
++#define IPV6CTL_RTHDR0_ALLOWED  46
++#define IPV6CTL_MAXID		47
+ #endif /* __BSD_VISIBLE */
+ 
+ /*
+Index: sys/netinet6/in6_proto.c
+===================================================================
+RCS file: /sources/FreeBSD-CVS/src/sys/netinet6/in6_proto.c,v
+retrieving revision 1.32.2.5
+diff -u -r1.32.2.5 in6_proto.c
+--- sys/netinet6/in6_proto.c	16 Oct 2006 15:11:18 -0000	1.32.2.5
++++ sys/netinet6/in6_proto.c	24 Apr 2007 07:46:54 -0000
+@@ -376,6 +376,8 @@
+ #ifdef IPSTEALTH
+ int	ip6stealth = 0;
+ #endif
++int     ip6_rthdr0_allowed = 0; /* Disallow use of routing header 0 */
++				/* by default. */
+ 
+ /* icmp6 */
+ /*
+@@ -519,6 +521,9 @@
+ SYSCTL_INT(_net_inet6_ip6, IPV6CTL_STEALTH, stealth, CTLFLAG_RW,
+ 	&ip6stealth, 0, "");
+ #endif
++SYSCTL_INT(_net_inet6_ip6, IPV6CTL_RTHDR0_ALLOWED, 
++	   rthdr0_allowed, CTLFLAG_RW, &ip6_rthdr0_allowed, 0, "");
++
+ 
+ /* net.inet6.icmp6 */
+ SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_REDIRACCEPT,
+Index: sys/netinet6/route6.c
+===================================================================
+RCS file: /sources/FreeBSD-CVS/src/sys/netinet6/route6.c,v
+retrieving revision 1.11.2.1
+diff -u -r1.11.2.1 route6.c
+--- sys/netinet6/route6.c	4 Nov 2005 20:26:15 -0000	1.11.2.1
++++ sys/netinet6/route6.c	24 Apr 2007 08:06:00 -0000
+@@ -49,6 +49,8 @@
+ 
+ #include <netinet/icmp6.h>
+ 
++extern int ip6_rthdr0_allowed;
++
+ static int ip6_rthdr0 __P((struct mbuf *, struct ip6_hdr *,
+     struct ip6_rthdr0 *));
+ 
+@@ -88,6 +90,8 @@
+ 
+ 	switch (rh->ip6r_type) {
+ 	case IPV6_RTHDR_TYPE_0:
++		if (!ip6_rthdr0_allowed)
++			return (IPPROTO_DONE);
+ 		rhlen = (rh->ip6r_len + 1) << 3;
+ #ifndef PULLDOWN_TEST
+ 		/*