d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix several bugs in the ARP code related to improperly formatted

Browse Source 
packets.

*) Reject requests with a protocol length not equal to 4.  This is IPv4
and there is no reason to accept anything else.

*) Reject packets that have a multicast source hardware address.

*) Drop requests where the hardware address length is not equal
to the hardware address length of the interface.

Pointed out by:	Rozhuk Ivan
MFC after:	1 week
This commit is contained in:
George V. Neville-Neil 2011-01-12 19:11:17 +00:00
parent 1af759d93a
commit 09d3f8953e
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sys/netinet/if_ether.c
View File

@ -531,6 +531,21 @@ in_arpinput(struct mbuf *m)
}
ah = mtod(m, struct arphdr *);
/*
* ARP is only for IPv4 so we can reject packets with
* a protocol length not equal to an IPv4 address.
*/
if (ah->ar_pln != sizeof(struct in_addr)) {
log(LOG_ERR, "in_arp: requested protocol length != %ld\n",
sizeof(struct in_addr));
return;
}
if (ETHER_IS_MULTICAST(ar_sha(ah))) {
log(LOG_ERR, "in_arp: source hardware address is multicast.");
return;
}
op = ntohs(ah->ar_op);
(void)memcpy(&isaddr, ar_spa(ah), sizeof (isaddr));
(void)memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr));
@ -702,7 +717,7 @@ in_arpinput(struct mbuf *m)
"arp from %*D: addr len: new %d, i/f %d (ignored)",
ifp->if_addrlen, (u_char *) ar_sha(ah), ":",
ah->ar_hln, ifp->if_addrlen);
goto reply;
goto drop;
}
(void)memcpy(&la->ll_addr, ar_sha(ah), ifp->if_addrlen);
la->la_flags |= LLE_VALID;