Skip to content

Commit 2af9a55

Browse files
lkundrakjpirko
authored andcommitted
libndb: reject redirect and router advertisements from non-link-local
RFC4861 suggests that these messages should only originate from link-local addresses in 6.1.2 (RA) and 8.1. (redirect): Mitigates CVE-2016-3698. Signed-off-by: Lubomir Rintel <lkundrak@v3.sk> Signed-off-by: Jiri Pirko <jiri@mellanox.com>
1 parent a4892df commit 2af9a55

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

Diff for: libndp/libndp.c

+13-1
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,7 @@ struct ndp_msg_type_info {
333333
uint8_t raw_type;
334334
size_t raw_struct_size;
335335
void (*addrto_adjust)(struct in6_addr *addr);
336+
bool (*addrto_validate)(struct in6_addr *addr);
336337
};
337338

338339
static void ndp_msg_addrto_adjust_all_nodes(struct in6_addr *addr)
@@ -359,6 +360,11 @@ static void ndp_msg_addrto_adjust_all_routers(struct in6_addr *addr)
359360
addr->s6_addr32[3] = htonl(0x2);
360361
}
361362

363+
static bool ndp_msg_addrto_validate_link_local(struct in6_addr *addr)
364+
{
365+
return IN6_IS_ADDR_LINKLOCAL (addr);
366+
}
367+
362368
static struct ndp_msg_type_info ndp_msg_type_info_list[] =
363369
{
364370
[NDP_MSG_RS] = {
@@ -371,6 +377,7 @@ static struct ndp_msg_type_info ndp_msg_type_info_list[] =
371377
.strabbr = "RA",
372378
.raw_type = ND_ROUTER_ADVERT,
373379
.raw_struct_size = sizeof(struct nd_router_advert),
380+
.addrto_validate = ndp_msg_addrto_validate_link_local,
374381
},
375382
[NDP_MSG_NS] = {
376383
.strabbr = "NS",
@@ -387,6 +394,7 @@ static struct ndp_msg_type_info ndp_msg_type_info_list[] =
387394
.strabbr = "R",
388395
.raw_type = ND_REDIRECT,
389396
.raw_struct_size = sizeof(struct nd_redirect),
397+
.addrto_validate = ndp_msg_addrto_validate_link_local,
390398
},
391399
};
392400

@@ -418,7 +426,11 @@ static bool ndp_msg_check_valid(struct ndp_msg *msg)
418426

419427
if (len < ndp_msg_type_info(msg_type)->raw_struct_size)
420428
return false;
421-
return true;
429+
430+
if (ndp_msg_type_info(msg_type)->addrto_validate)
431+
return ndp_msg_type_info(msg_type)->addrto_validate(&msg->addrto);
432+
else
433+
return true;
422434
}
423435

424436
static struct ndp_msg *ndp_msg_alloc(void)

0 commit comments

Comments
 (0)