patrick/zephyr
1
0
Fork 0
Code Issues Pull requests Actions 8 Packages Projects Releases Wiki Activity

net: ipv4: Check localhost for incoming packet

Browse source 
If we receive a packet from non localhost interface, then
drop it if either source or destination address is a localhost
address.

Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
This commit is contained in:
Jukka Rissanen 2023-12-19 11:16:59 +02:00 committed by Carles Cufí
parent 700f640948
commit 6d41e68352
5 changed files with 19 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
subsys/net/ip/ipv4.c
View file

@ -232,7 +232,7 @@ int net_ipv4_parse_hdr_options(struct net_pkt *pkt,
}
#endif
enum net_verdict net_ipv4_input(struct net_pkt *pkt)
enum net_verdict net_ipv4_input(struct net_pkt *pkt, bool is_loopback)
{
NET_PKT_DATA_ACCESS_CONTIGUOUS_DEFINE(ipv4_access, struct net_ipv4_hdr);
NET_PKT_DATA_ACCESS_DEFINE(udp_access, struct net_udp_hdr);
@ -293,6 +293,14 @@ enum net_verdict net_ipv4_input(struct net_pkt *pkt)
net_pkt_update_length(pkt, pkt_len);
}
if (!is_loopback) {
if (net_ipv4_is_addr_loopback((struct in_addr *)hdr->dst) ||
net_ipv4_is_addr_loopback((struct in_addr *)hdr->src)) {
NET_DBG("DROP: localhost packet");
goto drop;
}
}
if (net_ipv4_is_addr_mcast((struct in_addr *)hdr->src)) {
NET_DBG("DROP: src addr is %s", "mcast");
goto drop;

2
subsys/net/ip/net_core.c
View file

@ -135,7 +135,7 @@ static inline enum net_verdict process_data(struct net_pkt *pkt,
if (IS_ENABLED(CONFIG_NET_IPV6) && vtc_vhl == 0x60) {
return net_ipv6_input(pkt, is_loopback);
} else if (IS_ENABLED(CONFIG_NET_IPV4) && vtc_vhl == 0x40) {
return net_ipv4_input(pkt);
return net_ipv4_input(pkt, is_loopback);
}
NET_DBG("Unknown IP family packet (0x%x)", NET_IPV6_HDR(pkt)->vtc & 0xf0);

6
subsys/net/ip/net_private.h
View file

@ -107,12 +107,14 @@ static inline bool net_context_is_recv_pktinfo_set(struct net_context *context)
#endif
#if defined(CONFIG_NET_NATIVE)
enum net_verdict net_ipv4_input(struct net_pkt *pkt);
enum net_verdict net_ipv4_input(struct net_pkt *pkt, bool is_loopback);
enum net_verdict net_ipv6_input(struct net_pkt *pkt, bool is_loopback);
#else
static inline enum net_verdict net_ipv4_input(struct net_pkt *pkt)
static inline enum net_verdict net_ipv4_input(struct net_pkt *pkt,
bool is_loopback)
{
ARG_UNUSED(pkt);
ARG_UNUSED(is_loopback);
return NET_CONTINUE;
}

8
tests/net/icmpv4/src/main.c
View file

@ -452,7 +452,7 @@ static void icmpv4_send_echo_req(void)
zassert_true(false, "EchoRequest packet prep failed");
}
if (net_ipv4_input(pkt)) {
if (net_ipv4_input(pkt, false)) {
net_pkt_unref(pkt);
zassert_true(false, "Failed to send");
}
@ -474,7 +474,7 @@ static void icmpv4_send_echo_rep(void)
zassert_true(false, "EchoReply packet prep failed");
}
if (net_ipv4_input(pkt)) {
if (net_ipv4_input(pkt, false)) {
net_pkt_unref(pkt);
zassert_true(false, "Failed to send");
}
@ -494,7 +494,7 @@ ZTEST(net_icmpv4, test_icmpv4_send_echo_req_opt)
zassert_true(false, "EchoRequest with opts packet prep failed");
}
if (net_ipv4_input(pkt)) {
if (net_ipv4_input(pkt, false)) {
net_pkt_unref(pkt);
zassert_true(false, "Failed to send");
}
@ -510,7 +510,7 @@ ZTEST(net_icmpv4, test_send_echo_req_bad_opt)
"EchoRequest with bad opts packet prep failed");
}
if (net_ipv4_input(pkt)) {
if (net_ipv4_input(pkt, false)) {
net_pkt_unref(pkt);
}
}

2
tests/net/virtual/src/main.c
View file

@ -1040,7 +1040,7 @@ static void test_virtual_recv_data_from_tunnel(int remote_ip,
net_pkt_cursor_init(outer);
if (peer_addr.sa_family == AF_INET) {
verdict = net_ipv4_input(outer);
verdict = net_ipv4_input(outer, false);
} else {
verdict = net_ipv6_input(outer, false);
}