On Wed, May 14, 2014 at 01:22:25AM +0000, Edgar E. Iglesias wrote:
> On Wed, May 14, 2014 at 03:13:09AM +0200, Samuel Thibault wrote:
> > Do not special-case addresses with zero host part, as we do not
> > necessarily know how big it is, and the guest can fake them anyway.
> > Silently avoid having 0.0.0.0 as a destination, however.
> >
> > Signed-off-by: Samuel Thibault <samuel.thiba...@ens-lyon.org>
>
> Reviewed-by: Edgar E. Iglesias <edgar.igles...@xilinx.com>
Ping
>
> > ---
> >
> > This is particularly bad actually, one can for instance simply do this
> > inside a Linux guest
> >
> > ip addr add 192.0.0.0/1 dev eth0
> >
> > and crash qemu (thus a DoS) by just emitting a packet (thus from
> > 192.0.0.0), getting:
> >
> > qemu-system-x86_64: /usr/src/qemu/slirp/arp_table.c:77: arp_table_search:
> > Assertion `(ip_addr & __bswap_32 (~(0xfU << 28))) != 0' failed.
> >
> > so it should probably go to all stable maintained versions.
> >
> > diff --git a/slirp/arp_table.c b/slirp/arp_table.c
> > index ecdb0ba..bcaeb44 100644
> > --- a/slirp/arp_table.c
> > +++ b/slirp/arp_table.c
> > @@ -37,12 +37,7 @@ void arp_table_add(Slirp *slirp, uint32_t ip_addr,
> > uint8_t ethaddr[ETH_ALEN])
> > ethaddr[0], ethaddr[1], ethaddr[2],
> > ethaddr[3], ethaddr[4], ethaddr[5]));
> >
> > - /* Check 0.0.0.0/8 invalid source-only addresses */
> > - if ((ip_addr & htonl(~(0xfU << 28))) == 0) {
> > - return;
> > - }
> > -
> > - if (ip_addr == 0xffffffff || ip_addr == broadcast_addr) {
> > + if (ip_addr == 0 || ip_addr == 0xffffffff || ip_addr ==
> > broadcast_addr) {
> > /* Do not register broadcast addresses */
> > return;
> > }
> > @@ -73,9 +68,6 @@ bool arp_table_search(Slirp *slirp, uint32_t ip_addr,
> > DEBUG_CALL("arp_table_search");
> > DEBUG_ARG("ip = 0x%x", ip_addr);
> >
> > - /* Check 0.0.0.0/8 invalid source-only addresses */
> > - assert((ip_addr & htonl(~(0xfU << 28))) != 0);
> > -
> > /* If broadcast address */
> > if (ip_addr == 0xffffffff || ip_addr == broadcast_addr) {
> > /* return Ethernet broadcast address */
> > diff --git a/slirp/slirp.c b/slirp/slirp.c
> > index 3fb48a4..00f4eb5 100644
> > --- a/slirp/slirp.c
> > +++ b/slirp/slirp.c
> > @@ -778,6 +778,11 @@ int if_encap(Slirp *slirp, struct mbuf *ifm)
> > return 1;
> > }
> >
> > + if (iph->ip_dst.s_addr == 0) {
> > + /* 0.0.0.0 can not be a destination address, something went wrong,
> > + * avoid making it worse */
> > + return 1;
> > + }
> > if (!arp_table_search(slirp, iph->ip_dst.s_addr, ethaddr)) {
> > uint8_t arp_req[ETH_HLEN + sizeof(struct arphdr)];
> > struct ethhdr *reh = (struct ethhdr *)arp_req;
> >
