The current NDP implementation accepts NDP NS/NS with the broadcast (mcast, and null) MAC addresses as src/dst lladdr, and updates the neighbour cache for that host. Broadcast (and Multicast, see RFC1812, section 3.3.2) and null MAC addresses are reserved addresses and shall never be associated with a unicast or a multicast IPv6 address. NDP poisioning with a broadcast MAC address, especially when poisoning a Gateway IP, has some undesired implications compared to an NDP poisioning with a regular MAC. (see ARP bcast poison commit for more details). Worth mentioning that if an attacker is able to NDP poison in a L2 segment, that in itself is probably a bigger security threat (Man-in-middle etc.). However, since these MACs should never be announced as SHA, discard/drop NDP with lladdr={bcast, null}, which prevents the broadcast NDP poisoning vector. Signed-off-by: Marc Suñé --- net/ipv6/ndisc.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 59d17b6f06bf..980768a79092 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -830,6 +830,17 @@ static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb) return reason; } + /* + * Broadcast/Multicast and zero MAC addresses should + * never be announced and accepted as llsrc address (prevent + * NDP BCAST MAC poisoning attack). + */ + if (dev->addr_len == ETH_ALEN && + (is_broadcast_ether_addr(lladdr) || + is_zero_ether_addr(lladdr))) { + return reason; + } + /* RFC2461 7.1.1: * If the IP source address is the unspecified address, * there MUST NOT be source link-layer address option @@ -1033,6 +1044,17 @@ static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb) net_dbg_ratelimited("NA: invalid link-layer address length\n"); return reason; } + + /* + * Broadcast/Multicast and zero MAC addresses should + * never be announced and accepted as llsrc address (prevent + * NDP BCAST MAC poisoning attack). + */ + if (dev->addr_len == ETH_ALEN && + (is_broadcast_ether_addr(lladdr) || + is_zero_ether_addr(lladdr))) { + return reason; + } } ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); if (ifp) { -- 2.47.3