[src/trunk]: src/sys/netinet6 Mitigate Local Denial of Service with IPv6 Rout...

[roy <roy%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/996fe1422e78
branches:  trunk
changeset: 337876:996fe1422e78
user:      roy <roy%NetBSD.org@localhost>
date:      Sat May 02 14:28:30 2015 +0000

description:
Mitigate Local Denial of Service with IPv6 Router Advertisements and
log attack attempts.

Fixes CVE-2015-2923, taken from FreeBSD.

diffstat:

 sys/netinet6/nd6_rtr.c |  15 +++++++++++----
 1 files changed, 11 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r 4be26f7af4c5 -r 996fe1422e78 sys/netinet6/nd6_rtr.c
--- a/sys/netinet6/nd6_rtr.c    Sat May 02 14:10:03 2015 +0000
+++ b/sys/netinet6/nd6_rtr.c    Sat May 02 14:28:30 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nd6_rtr.c,v 1.98 2015/02/25 12:45:34 roy Exp $ */
+/*     $NetBSD: nd6_rtr.c,v 1.99 2015/05/02 14:28:30 roy Exp $ */
 /*     $KAME: nd6_rtr.c,v 1.95 2001/02/07 08:09:47 itojun Exp $        */
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6_rtr.c,v 1.98 2015/02/25 12:45:34 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6_rtr.c,v 1.99 2015/05/02 14:28:30 roy Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -272,8 +272,15 @@
        }
        if (nd_ra->nd_ra_retransmit)
                ndi->retrans = ntohl(nd_ra->nd_ra_retransmit);
-       if (nd_ra->nd_ra_curhoplimit)
-               ndi->chlim = nd_ra->nd_ra_curhoplimit;
+       if (nd_ra->nd_ra_curhoplimit) {
+               if (ndi->chlim < nd_ra->nd_ra_curhoplimit)
+                       ndi->chlim = nd_ra->nd_ra_curhoplimit;
+               else if (ndi->chlim != nd_ra->nd_ra_curhoplimit)
+                       log(LOG_ERR, "nd_ra_input: lower CurHopLimit sent from "
+                          "%s on %s (current=%d, received=%d), ignored\n",
+                          ip6_sprintf(&ip6->ip6_src),
+                          if_name(ifp), ndi->chlim, nd_ra->nd_ra_curhoplimit);
+       }
        dr = defrtrlist_update(&drtr);
     }