d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netinet: filter out invalid ICMP responses in ip_icmp()

Browse Source 
instead of doing that in every ipproto_ctlinput_t method.

Reviewed by:		melifaro
Differential revision:	https://reviews.freebsd.org/D36728
This commit is contained in:
Gleb Smirnoff 2022-10-03 20:53:04 -07:00
parent 53807a8a27
commit 7f3b00a87a
4 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/netinet/ip_icmp.c
View File

@ -546,6 +546,9 @@ icmp_input(struct mbuf **mp, int *offp, int proto)
/* Discard ICMP's in response to multicast packets */
if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
goto badcode;
/* Filter out responses to INADDR_ANY, protocols ignore it. */
if (icp->icmp_ip.ip_dst.s_addr == INADDR_ANY)
goto freeit;
#ifdef ICMPPRINTFS
if (icmpprintfs)
printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);

3
sys/netinet/sctp_usrreq.c
View File

@ -272,9 +272,6 @@ sctp_ctlinput(int cmd, struct sockaddr_in *sin, struct ip *ip)
struct sctp_init_chunk *ch;
struct sockaddr_in src, dst;
if (sin->sin_addr.s_addr == INADDR_ANY) {
return;
}
if (PRC_IS_REDIRECT(cmd)) {
ip = NULL;
} else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {

3
sys/netinet/tcp_subr.c
View File

@ -2866,9 +2866,6 @@ tcp_ctlinput_with_port(int cmd, struct sockaddr_in *sin, struct ip *ip,
tcp_seq icmp_tcp_seq;
int mtu;
if (sin->sin_addr.s_addr == INADDR_ANY)
return;
if (cmd == PRC_MSGSIZE)
notify = tcp_mtudisc_notify;
else if (V_icmp_may_rst && (cmd == PRC_UNREACH_ADMIN_PROHIB ||

3
sys/netinet/udp_usrreq.c
View File

@ -746,9 +746,6 @@ udp_common_ctlinput(int cmd, struct sockaddr_in *sin, struct ip *ip,
struct udphdr *uh;
struct inpcb *inp;
if (sin->sin_addr.s_addr == INADDR_ANY)
return;
if (PRC_IS_REDIRECT(cmd)) {
/* signal EHOSTDOWN, as it flushes the cached route */
in_pcbnotifyall(pcbinfo, sin->sin_addr, EHOSTDOWN, udp_notify);