From: Hans Dedecker Date: Tue, 24 Dec 2013 16:22:05 +0000 (+0100) Subject: Add ICMPv6 validity check X-Git-Tag: debian/1.1+git20160131-1~107^2~3 X-Git-Url: https://git.decadent.org.uk/gitweb/?a=commitdiff_plain;h=1339588a2a1143e4029a9e7558130c9b17fd6a3e;p=odhcp6c.git Add ICMPv6 validity check --- diff --git a/src/ra.c b/src/ra.c index de21710..58c8741 100644 --- a/src/ra.c +++ b/src/ra.c @@ -195,6 +195,32 @@ bool ra_link_up(void) return ret; } +static bool ra_icmpv6_valid(struct sockaddr_in6 *source, int hlim, uint8_t *data, size_t len) +{ + struct icmp6_hdr *hdr = (struct icmp6_hdr*)data; + struct icmpv6_opt *opt, *end = (struct icmpv6_opt*)&data[len]; + + if (hlim != 255 || len < sizeof(*hdr) || hdr->icmp6_code) + return false; + + switch (hdr->icmp6_type) { + case ND_ROUTER_ADVERT: + if (!IN6_IS_ADDR_LINKLOCAL(&source->sin6_addr)) + return false; + + opt = (struct icmpv6_opt*)((struct nd_router_advert*)data + 1); + break; + + default: + return false; + } + + icmpv6_for_each_option(opt, opt, end) + ; + + return opt == end; +} + bool ra_process(void) { bool found = false; @@ -226,10 +252,8 @@ bool ra_process(void) cmsg_buf, sizeof(cmsg_buf), 0}; ssize_t len = recvmsg(sock, &msg, MSG_DONTWAIT); - if (len < 0) + if (len <= 0) break; - else if (len < (ssize_t)sizeof(*adv)) - continue; int hlim = 0; for (struct cmsghdr *ch = CMSG_FIRSTHDR(&msg); ch != NULL; @@ -238,7 +262,7 @@ bool ra_process(void) ch->cmsg_type == IPV6_HOPLIMIT) memcpy(&hlim, CMSG_DATA(ch), sizeof(hlim)); - if (hlim != 255) + if (!ra_icmpv6_valid(&from, hlim, buf, len)) continue; // Stop sending solicits