diff options
| author | Roy Marples <roy@marples.name> | 2017-05-20 13:51:41 +0100 |
|---|---|---|
| committer | Roy Marples <roy@marples.name> | 2017-05-22 09:50:21 +0100 |
| commit | f58a7db77fd3dfec7f0d5c3630ecf906f300e9c1 (patch) | |
| tree | db9a3cf9bc03e6cec6f82352d7a791da4ef43fcb /src/ipv6nd.c | |
| parent | 3cf33877235502a3998fae72d4a1ac657ceb815e (diff) | |
| download | dhcpcd-f58a7db77fd3dfec7f0d5c3630ecf906f300e9c1.tar.xz | |
Hardware Address validation
Summary:
The all zero's and all one's hardware address are reserved.
As such, they should not be used in dhcpcd.
Likewise, Router Solicitation messages should not contain an
all zero source address option.
Fixes T119.
Test Plan:
Request IPv6RA over a PPP interface on a suitable OS which assigns
an all zero's or all one's hardware address.
Maniphest Tasks: T119
Differential Revision: https://dev.marples.name/D114
Diffstat (limited to 'src/ipv6nd.c')
| -rw-r--r-- | src/ipv6nd.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/src/ipv6nd.c b/src/ipv6nd.c index dbae9b79..5c9384fe 100644 --- a/src/ipv6nd.c +++ b/src/ipv6nd.c @@ -237,11 +237,12 @@ ipv6nd_makersprobe(struct interface *ifp) { struct rs_state *state; struct nd_router_solicit *rs; - struct nd_opt_hdr *nd; state = RS_STATE(ifp); free(state->rs); - state->rslen = sizeof(*rs) + (size_t)ROUNDUP8(ifp->hwlen + 2); + state->rslen = sizeof(*rs); + if (ifp->hwlen != 0) + state->rslen += (size_t)ROUNDUP8(ifp->hwlen + 2); state->rs = calloc(1, state->rslen); if (state->rs == NULL) return -1; @@ -250,10 +251,15 @@ ipv6nd_makersprobe(struct interface *ifp) rs->nd_rs_code = 0; rs->nd_rs_cksum = 0; rs->nd_rs_reserved = 0; - nd = (struct nd_opt_hdr *)(state->rs + sizeof(*rs)); - nd->nd_opt_type = ND_OPT_SOURCE_LINKADDR; - nd->nd_opt_len = (uint8_t)((ROUNDUP8(ifp->hwlen + 2)) >> 3); - memcpy(nd + 1, ifp->hwaddr, ifp->hwlen); + + if (ifp->hwlen != 0) { + struct nd_opt_hdr *nd; + + nd = (struct nd_opt_hdr *)(state->rs + sizeof(*rs)); + nd->nd_opt_type = ND_OPT_SOURCE_LINKADDR; + nd->nd_opt_len = (uint8_t)((ROUNDUP8(ifp->hwlen + 2)) >> 3); + memcpy(nd + 1, ifp->hwaddr, ifp->hwlen); + } return 0; } |