Blame SOURCES/0005-igmp-trusted-query.patch
|
 |
4c39c9 |
From ff4516227cc48b3175106a419f43b8fc9eee3710 Mon Sep 17 00:00:00 2001
|
|
|
4c39c9 |
From: Donald Sharp <sharpd@cumulusnetworks.com>
|
|
|
4c39c9 |
Date: Tue, 25 Jun 2019 00:30:11 -0400
|
|
|
4c39c9 |
Subject: [PATCH] pimd: Dissallow query to be received from a non-connected
|
|
|
4c39c9 |
source
|
|
|
4c39c9 |
|
|
|
4c39c9 |
When we receive an igmp query on a interface, ensure that the
|
|
|
4c39c9 |
source address of the packet is connected to the incoming
|
|
|
4c39c9 |
interface. This will prevent a meanie from crafting a igmp
|
|
|
4c39c9 |
packet with a source address less than ours and causing
|
|
|
4c39c9 |
us to suspend query activities.
|
|
|
4c39c9 |
|
|
|
4c39c9 |
Fixes: #1692
|
|
|
4c39c9 |
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
|
|
|
4c39c9 |
---
|
|
|
4c39c9 |
pimd/pim_igmp.c | 7 +++++++
|
|
|
4c39c9 |
1 file changed, 7 insertions(+)
|
|
|
4c39c9 |
|
|
|
4c39c9 |
diff --git a/pimd/pim_igmp.c b/pimd/pim_igmp.c
|
|
|
4c39c9 |
index 270f1e3f27..5beabbd8df 100644
|
|
|
4c39c9 |
--- a/pimd/pim_igmp.c
|
|
|
4c39c9 |
+++ b/pimd/pim_igmp.c
|
|
|
4c39c9 |
@@ -305,6 +305,13 @@ static int igmp_recv_query(struct igmp_sock *igmp, int query_version,
|
|
|
4c39c9 |
return -1;
|
|
|
4c39c9 |
}
|
|
|
4c39c9 |
|
|
|
4c39c9 |
+ if (!pim_if_connected_to_source(ifp, from)) {
|
|
|
4c39c9 |
+ if (PIM_DEBUG_IGMP_PACKETS)
|
|
|
4c39c9 |
+ zlog_debug("Recv IGMP query on interface: %s from a non-connected source: %s",
|
|
|
4c39c9 |
+ ifp->name, from_str);
|
|
|
4c39c9 |
+ return 0;
|
|
|
4c39c9 |
+ }
|
|
|
4c39c9 |
+
|
|
|
4c39c9 |
/* Collecting IGMP Rx stats */
|
|
|
4c39c9 |
switch (query_version) {
|
|
|
4c39c9 |
case 1:
|