hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-15 23:05:49 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Extra sanity check when arp proxyall is enabled. Don't send an arp

Browse Source 
reply if the requesting machine isn't on the interface we believe
it should be. Prevents arp wars when you plug cables in the wrong
way around.

PR:		9848
Submitted by:	Ian Dowse <iedowse@maths.tcd.ie>
Not objected to by:	wollman
This commit is contained in:
David Malone 2000-07-13 19:31:01 +00:00
parent c033c5d054
commit cc72822764
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=63080
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
sys/netinet/if_ether.c
View File

@ -666,6 +666,32 @@ reply:
(void)memcpy(ea->arp_tha, ea->arp_sha, sizeof(ea->arp_sha));
(void)memcpy(ea->arp_sha, ac->ac_enaddr, sizeof(ea->arp_sha));
rtfree(rt);
/*
* Also check that the node which sent the ARP packet
* is on the the interface we expect it to be on. This
* avoids ARP chaos if an interface is connected to the
* wrong network.
*/
sin.sin_addr = isaddr;
rt = rtalloc1((struct sockaddr *)&sin, 0, 0UL);
if (!rt) {
m_freem(m);
return;
}
if (rt->rt_ifp != &ac->ac_if) {
log(LOG_INFO, "arp_proxy: ignoring request"
" from %s via %s%d, expecting %s%d\n",
inet_ntoa(isaddr), ac->ac_if.if_name,
ac->ac_if.if_unit, rt->rt_ifp->if_name,
rt->rt_ifp->if_unit);
rtfree(rt);
m_freem(m);
return;
}
rtfree(rt);
#ifdef DEBUG_PROXY
printf("arp: proxying for %s\n",
inet_ntoa(itaddr));