[PATCH net 1/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@xxxxxxxxx>

RFC 6554 requires an RPL router to drop a packet when two or more
addresses assigned to the router are separated in the SRH by an address
not assigned to it.

ipv6_chk_rpl_srh_loop() checks found > 1 before counting the current
local address. For the shortest invalid sequence -- local, non-local,
local -- found is 1 at the second local address and the SRH is accepted.

Check whether a local address was seen before the separation instead.
The receive path calls this helper before forwarding an RPL SRH, and
RFC 6554 requires the check to mitigate bandwidth-exhaustion attacks.

Fixes: f37c60593634 ("addrconf: add functionality to check on rpl requirements")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Mark Amirkan <markdamirkan@xxxxxxxxx>
Assisted-by: Symbolic
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9d89be7e0544..f678fb7fa574 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4621,7 +4621,7 @@ int ipv6_chk_rpl_srh_loop(struct net *net, const struct in6_addr *segs,
 		}
 
 		if (hash_found) {
-			if (found > 1 && separated) {
+			if (found && separated) {
 				ret = 1;
 				break;
 			}

-- 
2.43.0