aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Stevens <dlstevens@us.ibm.com>2005-12-02 23:32:59 -0500
committerDavid S. Miller <davem@davemloft.net>2005-12-02 23:32:59 -0500
commit24c6927505ca77ee4ac25fb31dcd56f6506979ed (patch)
tree17d873b63f0ce24b81e184f2515f2b643143e48e
parentbf031fff1fac77775b2cd2c72ad8b017f4c0af13 (diff)
[IGMP]: workaround for IGMP v1/v2 bug
From: David Stevens <dlstevens@us.ibm.com> As explained at: http://www.cs.ucsb.edu/~krishna/igmp_dos/ With IGMP version 1 and 2 it is possible to inject a unicast report to a client which will make it ignore multicast reports sent later by the router. The fix is to only accept the report if is was sent to a multicast or unicast address. Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/ipv4/igmp.c5
-rw-r--r--net/ipv6/mcast.c5
2 files changed, 9 insertions, 1 deletions
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index c04607b49212..4a195c724f01 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -897,7 +897,10 @@ int igmp_rcv(struct sk_buff *skb)
897 /* Is it our report looped back? */ 897 /* Is it our report looped back? */
898 if (((struct rtable*)skb->dst)->fl.iif == 0) 898 if (((struct rtable*)skb->dst)->fl.iif == 0)
899 break; 899 break;
900 igmp_heard_report(in_dev, ih->group); 900 /* don't rely on MC router hearing unicast reports */
901 if (skb->pkt_type == PACKET_MULTICAST ||
902 skb->pkt_type == PACKET_BROADCAST)
903 igmp_heard_report(in_dev, ih->group);
901 break; 904 break;
902 case IGMP_PIM: 905 case IGMP_PIM:
903#ifdef CONFIG_IP_PIMSM_V1 906#ifdef CONFIG_IP_PIMSM_V1
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f15e04ad026e..fd939da090c4 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1231,6 +1231,11 @@ int igmp6_event_report(struct sk_buff *skb)
1231 if (skb->pkt_type == PACKET_LOOPBACK) 1231 if (skb->pkt_type == PACKET_LOOPBACK)
1232 return 0; 1232 return 0;
1233 1233
1234 /* send our report if the MC router may not have heard this report */
1235 if (skb->pkt_type != PACKET_MULTICAST &&
1236 skb->pkt_type != PACKET_BROADCAST)
1237 return 0;
1238
1234 if (!pskb_may_pull(skb, sizeof(struct in6_addr))) 1239 if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
1235 return -EINVAL; 1240 return -EINVAL;
1236 1241