diff options
| author | hrs <hrs@FreeBSD.org> | 2014-09-21 04:00:28 +0000 |
|---|---|---|
| committer | hrs <hrs@FreeBSD.org> | 2014-09-21 04:00:28 +0000 |
| commit | 7aad5f07dd745c64641accd3029c2fc8da353ce0 (patch) | |
| tree | 52206f0416a0c331853b65b12c56c7cf6ca7e2d9 /sbin/routed/input.c | |
| parent | ffad09823e2578c36854d324de50f74b278d443c (diff) | |
| download | FreeBSD-src-7aad5f07dd745c64641accd3029c2fc8da353ce0.zip FreeBSD-src-7aad5f07dd745c64641accd3029c2fc8da353ce0.tar.gz | |
Fix a bug which could make routed(8) daemon exit by sending a special RIP
query from a remote machine, and disable accepting it by default. This
requests a routed(8) daemon to dump routing information base for debugging
purpose. An -i flag to enable it has been added.
Diffstat (limited to 'sbin/routed/input.c')
| -rw-r--r-- | sbin/routed/input.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/sbin/routed/input.c b/sbin/routed/input.c index 8f8eefc..901c4f3 100644 --- a/sbin/routed/input.c +++ b/sbin/routed/input.c @@ -289,8 +289,19 @@ input(struct sockaddr_in *from, /* received from this IP address */ * with all we know. */ if (from->sin_port != htons(RIP_PORT)) { - supply(from, aifp, OUT_QUERY, 0, - rip->rip_vers, ap != 0); + /* + * insecure: query from non-router node + * > 1: allow from distant node + * > 0: allow from neighbor node + * == 0: deny + */ + if ((aifp != NULL && insecure > 0) || + (aifp == NULL && insecure > 1)) + supply(from, aifp, OUT_QUERY, 0, + rip->rip_vers, ap != 0); + else + trace_pkt("Warning: " + "possible attack detected"); return; } |
