Prior to this commit, the NDP implementation accepted NDP NS/NA with the broadcast, multicast and null addresses as src/dst lladdr, and updated the neighbour cache for that host. Broadcast, multicast and null MAC addresses shall never be associated with a unicast or a multicast IPv6 address (see RFC1812, section 3.3.2). NDP poisioning with a broadcast MAC and certain multicast MAC addresses, especially when poisoning a Gateway IP, have some undesired implications compared to an NDP poisioning with a regular MAC (see ARP bcast poison commit for more details). Since these MACs should never be announced, discard/drop NDP with lladdr={bcast, null}, which prevents the broadcast/multicast NDP poisoning vector. Signed-off-by: Marc Suñé --- net/ipv6/ndisc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index f6a5d8c73af9..34202a816a4f 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -830,6 +830,14 @@ static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb) return reason; } + /* + * Broadcast/Multicast and zero MAC addresses should + * never be announced and accepted as llsrc address (prevent + * NDP B/MCAST MAC poisoning attack). + */ + if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(lladdr)) + return reason; + /* RFC2461 7.1.1: * If the IP source address is the unspecified address, * there MUST NOT be source link-layer address option @@ -1033,6 +1041,14 @@ static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb) net_dbg_ratelimited("NA: invalid link-layer address length\n"); return reason; } + + /* + * Broadcast/Multicast and zero MAC addresses should + * never be announced and accepted as llsrc address (prevent + * NDP B/MCAST MAC poisoning attack). + */ + if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(lladdr)) + return reason; } ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); if (ifp) { -- 2.47.3