From 31dade5c8b78cac508623d090a915654d86504a5 Mon Sep 17 00:00:00 2001 From: gnn Date: Wed, 12 Jan 2011 19:11:17 +0000 Subject: Fix several bugs in the ARP code related to improperly formatted packets. *) Reject requests with a protocol length not equal to 4. This is IPv4 and there is no reason to accept anything else. *) Reject packets that have a multicast source hardware address. *) Drop requests where the hardware address length is not equal to the hardware address length of the interface. Pointed out by: Rozhuk Ivan MFC after: 1 week --- sys/netinet/if_ether.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'sys/netinet/if_ether.c') diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c index f85965c..45786a9 100644 --- a/sys/netinet/if_ether.c +++ b/sys/netinet/if_ether.c @@ -531,6 +531,21 @@ in_arpinput(struct mbuf *m) } ah = mtod(m, struct arphdr *); + /* + * ARP is only for IPv4 so we can reject packets with + * a protocol length not equal to an IPv4 address. + */ + if (ah->ar_pln != sizeof(struct in_addr)) { + log(LOG_ERR, "in_arp: requested protocol length != %ld\n", + sizeof(struct in_addr)); + return; + } + + if (ETHER_IS_MULTICAST(ar_sha(ah))) { + log(LOG_ERR, "in_arp: source hardware address is multicast."); + return; + } + op = ntohs(ah->ar_op); (void)memcpy(&isaddr, ar_spa(ah), sizeof (isaddr)); (void)memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr)); @@ -702,7 +717,7 @@ match: "arp from %*D: addr len: new %d, i/f %d (ignored)", ifp->if_addrlen, (u_char *) ar_sha(ah), ":", ah->ar_hln, ifp->if_addrlen); - goto reply; + goto drop; } (void)memcpy(&la->ll_addr, ar_sha(ah), ifp->if_addrlen); la->la_flags |= LLE_VALID; -- cgit v1.1