From owner-svn-src-all@freebsd.org Mon Sep 14 10:28:48 2015 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6C28EA04486; Mon, 14 Sep 2015 10:28:48 +0000 (UTC) (envelope-from melifaro@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 519871AF0; Mon, 14 Sep 2015 10:28:48 +0000 (UTC) (envelope-from melifaro@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.70]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id t8EASm9n096160; Mon, 14 Sep 2015 10:28:48 GMT (envelope-from melifaro@FreeBSD.org) Received: (from melifaro@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id t8EASmUe096159; Mon, 14 Sep 2015 10:28:48 GMT (envelope-from melifaro@FreeBSD.org) Message-Id: <201509141028.t8EASmUe096159@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: melifaro set sender to melifaro@FreeBSD.org using -f From: "Alexander V. Chernikov" Date: Mon, 14 Sep 2015 10:28:48 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r287779 - head/sys/netinet X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Sep 2015 10:28:48 -0000 Author: melifaro Date: Mon Sep 14 10:28:47 2015 New Revision: 287779 URL: https://svnweb.freebsd.org/changeset/base/287779 Log: * Improve error checking for arp messages. * Clean stale headers from if_ether.c. Reported by: rozhuk.im at gmail.com Reviewed by: ae MFC after: 2 weeks Modified: head/sys/netinet/if_ether.c Modified: head/sys/netinet/if_ether.c ============================================================================== --- head/sys/netinet/if_ether.c Mon Sep 14 09:56:01 2015 (r287778) +++ head/sys/netinet/if_ether.c Mon Sep 14 10:28:47 2015 (r287779) @@ -58,7 +58,6 @@ __FBSDID("$FreeBSD$"); #include #include #include -#include #include #include #include @@ -71,9 +70,6 @@ __FBSDID("$FreeBSD$"); #include #endif -#include -#include - #include #define SIN(s) ((const struct sockaddr_in *)(s)) @@ -529,6 +525,8 @@ static void arpintr(struct mbuf *m) { struct arphdr *ar; + char *layer; + int hlen; if (m->m_len < sizeof(struct arphdr) && ((m = m_pullup(m, sizeof(struct arphdr))) == NULL)) { @@ -537,26 +535,56 @@ arpintr(struct mbuf *m) } ar = mtod(m, struct arphdr *); - if (ntohs(ar->ar_hrd) != ARPHRD_ETHER && - ntohs(ar->ar_hrd) != ARPHRD_IEEE802 && - ntohs(ar->ar_hrd) != ARPHRD_ARCNET && - ntohs(ar->ar_hrd) != ARPHRD_IEEE1394 && - ntohs(ar->ar_hrd) != ARPHRD_INFINIBAND) { - log(LOG_NOTICE, "arp: unknown hardware address format (0x%2D)" - " (from %*D to %*D)\n", (unsigned char *)&ar->ar_hrd, "", - ETHER_ADDR_LEN, (u_char *)ar_sha(ar), ":", - ETHER_ADDR_LEN, (u_char *)ar_tha(ar), ":"); + /* Check if length is sufficient */ + if ((m = m_pullup(m, arphdr_len(ar))) == NULL) { + log(LOG_NOTICE, "arp: short header received\n"); + return; + } + ar = mtod(m, struct arphdr *); + + hlen = 0; + layer = ""; + switch (ntohs(ar->ar_hrd)) { + case ARPHRD_ETHER: + hlen = ETHER_ADDR_LEN; /* RFC 826 */ + layer = "ethernet"; + break; + case ARPHRD_IEEE802: + hlen = 6; /* RFC 1390, FDDI_ADDR_LEN */ + layer = "fddi"; + break; + case ARPHRD_ARCNET: + hlen = 1; /* RFC 1201, ARC_ADDR_LEN */ + layer = "arcnet"; + break; + case ARPHRD_INFINIBAND: + hlen = 20; /* RFC 4391, INFINIBAND_ALEN */ + layer = "infiniband"; + break; + case ARPHRD_IEEE1394: + hlen = 0; /* SHALL be 16 */ /* RFC 2734 */ + layer = "firewire"; + + /* + * Restrict too long harware addresses. + * Currently we are capable of handling 20-byte + * addresses ( sizeof(lle->ll_addr) ) + */ + if (ar->ar_hln >= 20) + hlen = 16; + break; + default: + log(LOG_NOTICE, "arp: unknown hardware address format (0x%2d)\n", + htons(ar->ar_hrd)); m_freem(m); return; } - if (m->m_len < arphdr_len(ar)) { - if ((m = m_pullup(m, arphdr_len(ar))) == NULL) { - log(LOG_NOTICE, "arp: runt packet\n"); - m_freem(m); - return; - } - ar = mtod(m, struct arphdr *); + if (hlen != 0 && hlen != ar->ar_hln) { + log(LOG_NOTICE, "arp: bad %s header length: %d\n", layer, + ar->ar_hln); + m_freem(m); + return; } ARPSTAT_INC(received);