diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2025-01-16 15:46:37 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2025-01-16 16:45:16 +0000 |
| commit | 40faf87894ff67ffdf8126fce9bb438ddf61a26f (patch) | |
| tree | 961bfc9bc4fb4ea51ec9412b2817d01abccd068a /sys/netinet6 | |
| parent | 886396f1b1a727c642071965612e2c2c9dd11d6c (diff) | |
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/ip6_fastfwd.c | 1 | ||||
| -rw-r--r-- | sys/netinet6/ip6_input.c | 17 |
2 files changed, 15 insertions, 3 deletions
diff --git a/sys/netinet6/ip6_fastfwd.c b/sys/netinet6/ip6_fastfwd.c index 08531cee05bf..0ed313bd49a5 100644 --- a/sys/netinet6/ip6_fastfwd.c +++ b/sys/netinet6/ip6_fastfwd.c @@ -107,6 +107,7 @@ ip6_tryforward(struct mbuf *m) IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) || IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) || + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) || IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || in6_localip(&ip6->ip6_dst)) return (m); diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c index ec819a12628d..68e4be66537b 100644 --- a/sys/netinet6/ip6_input.c +++ b/sys/netinet6/ip6_input.c @@ -621,10 +621,10 @@ ip6_input(struct mbuf *m) IP_PROBE(receive, NULL, NULL, ip6, rcvif, NULL, ip6); /* - * Check against address spoofing/corruption. + * Check against address spoofing/corruption. The unspecified address + * is checked further below. */ - if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { + if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) { /* * XXX: "badscope" is not very suitable for a multicast source. */ @@ -750,6 +750,17 @@ ip6_input(struct mbuf *m) passin: /* + * The check is deferred to here to give firewalls a chance to block + * (and log) such packets. ip6_tryforward() will not process such + * packets. + */ + if (__predict_false(IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst))) { + IP6STAT_INC(ip6s_badscope); + in6_ifstat_inc(rcvif, ifs6_in_addrerr); + goto bad; + } + + /* * Disambiguate address scope zones (if there is ambiguity). * We first make sure that the original source or destination address * is not in our internal form for scoped addresses. Such addresses |