ipv6: protect protocols not handling ipv4 from v4 connection/bind attempts

Some ipv6 protocols cannot handle ipv4 addresses, so we must not allow
connecting and binding to them. sendmsg logic does already check msg->name
for this but must trust already connected sockets which could be set up
for connection to ipv4 address family.

Per-socket flag ipv6only is of no use here, as it is under users control
by setsockopt.

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 78d3d5124918947e9d6402796a2c795743cfbf0a..4f541f11ce632004ceaf9d461aeca80ece03dc9d 100644 (file)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -783,6 +783,8 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, int __user *optlen);
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
+int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *addr,
+                                int addr_len);
 
 int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
                    int *addr_len);

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 4a9e4266a0c3bf6aa98701cc4a0c7ac223a5f86e..2d11c094296e77ceb36b4121df01d7e5318de591 100644 (file)
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -320,6 +320,9 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                if (addr_len < sizeof(*addr))
                        return -EINVAL;
 
+               if (addr->sin6_family != AF_INET6)
+                       return -EINVAL;
+
                pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                         sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
 

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index cd8699bd2e6b1e8e1de17fb9a1d8ef63867cc2e7..2f5e2f154d2133a007baf154054522a2a66c17ad 100644 (file)
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -205,6 +205,16 @@ out:
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_connect);
 
+int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr,
+                                int addr_len)
+{
+       DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, uaddr);
+       if (sin6->sin6_family != AF_INET6)
+               return -EAFNOSUPPORT;
+       return ip6_datagram_connect(sk, uaddr, addr_len);
+}
+EXPORT_SYMBOL_GPL(ip6_datagram_connect_v6_only);
+
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                     __be16 port, u32 info, u8 *payload)
 {

diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 94a3d04c3200441a10ea578f073785a20c2c5761..fb9beb78f00b23fc307384bf6aef21adf2ab6895 100644 (file)
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -31,7 +31,7 @@ struct proto pingv6_prot = {
        .owner =        THIS_MODULE,
        .init =         ping_init_sock,
        .close =        ping_close,
-       .connect =      ip6_datagram_connect,
+       .connect =      ip6_datagram_connect_v6_only,
        .disconnect =   udp_disconnect,
        .setsockopt =   ipv6_setsockopt,
        .getsockopt =   ipv6_getsockopt,

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index b4523117aeae102cd415a0b6bdadee034ba6184e..1f29996e368a23e67bfe09d9b2ff10bd9b61805d 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -250,6 +250,10 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
        if (addr_len < SIN6_LEN_RFC2133)
                return -EINVAL;
+
+       if (addr->sin6_family != AF_INET6)
+               return -EINVAL;
+
        addr_type = ipv6_addr_type(&addr->sin6_addr);
 
        /* Raw sockets are IPv6 only */
@@ -1209,7 +1213,7 @@ struct proto rawv6_prot = {
        .owner             = THIS_MODULE,
        .close             = rawv6_close,
        .destroy           = raw6_destroy,
-       .connect           = ip6_datagram_connect,
+       .connect           = ip6_datagram_connect_v6_only,
        .disconnect        = udp_disconnect,
        .ioctl             = rawv6_ioctl,
        .init              = rawv6_init_sk,

diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index aab5f74e91e62382894f1f38dba213ea9a3b1775..7704ea9502fdc9e49a2b8bb7fda4b9b9ec8d1722 100644 (file)
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -371,6 +371,9 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
        if (addr_len < sizeof(*lsa))
                return -EINVAL;
 
+       if (usin->sin6_family != AF_INET6)
+               return -EINVAL;
+
        addr_type = ipv6_addr_type(&usin->sin6_addr);
        if (addr_type & IPV6_ADDR_MULTICAST)
                return -EINVAL;