diff options
author | gnn <gnn@FreeBSD.org> | 2011-01-12 19:11:17 +0000 |
---|---|---|
committer | gnn <gnn@FreeBSD.org> | 2011-01-12 19:11:17 +0000 |
commit | 31dade5c8b78cac508623d090a915654d86504a5 (patch) | |
tree | c55eb265d80d2bea0a03d2080aa609e22b1f7ac6 | |
parent | efcb28e8ec3bea93bfd0441637a89ca11b0630b2 (diff) | |
download | FreeBSD-src-31dade5c8b78cac508623d090a915654d86504a5.zip FreeBSD-src-31dade5c8b78cac508623d090a915654d86504a5.tar.gz |
Fix several bugs in the ARP code related to improperly formatted
packets.
*) Reject requests with a protocol length not equal to 4. This is IPv4
and there is no reason to accept anything else.
*) Reject packets that have a multicast source hardware address.
*) Drop requests where the hardware address length is not equal
to the hardware address length of the interface.
Pointed out by: Rozhuk Ivan
MFC after: 1 week
-rw-r--r-- | sys/netinet/if_ether.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c index f85965c..45786a9 100644 --- a/sys/netinet/if_ether.c +++ b/sys/netinet/if_ether.c @@ -531,6 +531,21 @@ in_arpinput(struct mbuf *m) } ah = mtod(m, struct arphdr *); + /* + * ARP is only for IPv4 so we can reject packets with + * a protocol length not equal to an IPv4 address. + */ + if (ah->ar_pln != sizeof(struct in_addr)) { + log(LOG_ERR, "in_arp: requested protocol length != %ld\n", + sizeof(struct in_addr)); + return; + } + + if (ETHER_IS_MULTICAST(ar_sha(ah))) { + log(LOG_ERR, "in_arp: source hardware address is multicast."); + return; + } + op = ntohs(ah->ar_op); (void)memcpy(&isaddr, ar_spa(ah), sizeof (isaddr)); (void)memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr)); @@ -702,7 +717,7 @@ match: "arp from %*D: addr len: new %d, i/f %d (ignored)", ifp->if_addrlen, (u_char *) ar_sha(ah), ":", ah->ar_hln, ifp->if_addrlen); - goto reply; + goto drop; } (void)memcpy(&la->ll_addr, ar_sha(ah), ifp->if_addrlen); la->la_flags |= LLE_VALID; |