[src/trunk]: src/sys drop IPv6 packets with v4 mapped address on src/dst. th...

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ff66bf623e56
branches:  trunk
changeset: 479811:ff66bf623e56
user:      itojun <itojun%NetBSD.org@localhost>
date:      Wed Dec 22 04:03:01 1999 +0000

description:
drop IPv6 packets with v4 mapped address on src/dst.  they are illegal
and may be used to fool IPv6 implementations (by using ::ffff:127.0.0.1 as
source you may be able to pretend the packet is from local node)

diffstat:

 sys/netinet/tcp_input.c    |   9 ++++++++-
 sys/netinet/udp_usrreq.c   |   9 ++++++++-
 sys/netinet6/raw_ip6.c     |  11 ++++++++++-
 sys/netinet6/udp6_usrreq.c |   9 ++++++++-
 4 files changed, 34 insertions(+), 4 deletions(-)

diffs (94 lines):

diff -r 379867c189a7 -r ff66bf623e56 sys/netinet/tcp_input.c
--- a/sys/netinet/tcp_input.c   Wed Dec 22 03:58:12 1999 +0000
+++ b/sys/netinet/tcp_input.c   Wed Dec 22 04:03:01 1999 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tcp_input.c,v 1.100 1999/12/15 06:28:43 itojun Exp $   */
+/*     $NetBSD: tcp_input.c,v 1.101 1999/12/22 04:03:02 itojun Exp $   */
 
 /*
 %%% portions-copyright-nrl-95
@@ -668,6 +668,13 @@
                }
 #endif
 
+               /* Be proactive about malicious use of IPv4 mapped address */
+               if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
+                   IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
+                       /* XXX stat */
+                       goto drop;
+               }
+
                /*
                 * Checksum extended TCP header and data.
                 */
diff -r 379867c189a7 -r ff66bf623e56 sys/netinet/udp_usrreq.c
--- a/sys/netinet/udp_usrreq.c  Wed Dec 22 03:58:12 1999 +0000
+++ b/sys/netinet/udp_usrreq.c  Wed Dec 22 04:03:01 1999 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: udp_usrreq.c,v 1.53 1999/12/13 15:17:21 itojun Exp $   */
+/*     $NetBSD: udp_usrreq.c,v 1.54 1999/12/22 04:03:01 itojun Exp $   */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -375,6 +375,13 @@
                goto bad;
        }
 
+       /* Be proactive about malicious use of IPv4 mapped address */
+       if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
+           IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
+               /* XXX stat */
+               goto bad;
+       }
+
        /*
         * Checksum extended UDP header and data.
         */
diff -r 379867c189a7 -r ff66bf623e56 sys/netinet6/raw_ip6.c
--- a/sys/netinet6/raw_ip6.c    Wed Dec 22 03:58:12 1999 +0000
+++ b/sys/netinet6/raw_ip6.c    Wed Dec 22 04:03:01 1999 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: raw_ip6.c,v 1.13 1999/12/15 06:28:44 itojun Exp $      */
+/*     $NetBSD: raw_ip6.c,v 1.14 1999/12/22 04:03:04 itojun Exp $      */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -143,6 +143,15 @@
                }
        }
 #endif
+
+       /* Be proactive about malicious use of IPv4 mapped address */
+       if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
+           IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
+               /* XXX stat */
+               m_freem(m);
+               return IPPROTO_DONE;
+       }
+
        bzero(&rip6src, sizeof(rip6src));
        rip6src.sin6_len = sizeof(struct sockaddr_in6);
        rip6src.sin6_family = AF_INET6;
diff -r 379867c189a7 -r ff66bf623e56 sys/netinet6/udp6_usrreq.c
--- a/sys/netinet6/udp6_usrreq.c        Wed Dec 22 03:58:12 1999 +0000
+++ b/sys/netinet6/udp6_usrreq.c        Wed Dec 22 04:03:01 1999 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: udp6_usrreq.c,v 1.15 1999/12/15 06:28:45 itojun Exp $  */
+/*     $NetBSD: udp6_usrreq.c,v 1.16 1999/12/22 04:03:03 itojun Exp $  */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -197,6 +197,13 @@
                goto bad;
        }
 
+       /* Be proactive about malicious use of IPv4 mapped address */
+       if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
+           IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
+               /* XXX stat */
+               goto bad;
+       }
+
        /*
         * Checksum extended UDP header and data.
         */