Re: [PATCH net] net/ipv4: defensive cipso option parsing

2018-09-17 Thread Nuernberger, Stefan
On Mon, 2018-09-17 at 12:35 -0400, Paul Moore wrote: > On Mon, Sep 17, 2018 at 11:12 AM Stefan Nuernberger > wrote: > > > > commit 40413955ee26 ("Cipso: cipso_v4_optptr enter infinite loop") > > fixed > > a possible infinite loop in the IP option parsing of CIPSO. The fix > > assumes that ip_opti

Re: [PATCH net] net/ipv4: defensive cipso option parsing

2018-09-17 Thread Paul Moore
On Mon, Sep 17, 2018 at 11:12 AM Stefan Nuernberger wrote: > commit 40413955ee26 ("Cipso: cipso_v4_optptr enter infinite loop") fixed > a possible infinite loop in the IP option parsing of CIPSO. The fix > assumes that ip_options_compile filtered out all zero length options and > that no other one

[PATCH net] net/ipv4: defensive cipso option parsing

2018-09-17 Thread Stefan Nuernberger
commit 40413955ee26 ("Cipso: cipso_v4_optptr enter infinite loop") fixed a possible infinite loop in the IP option parsing of CIPSO. The fix assumes that ip_options_compile filtered out all zero length options and that no other one-byte options beside IPOPT_END and IPOPT_NOOP exist. While this assu