net/icmp: check src ip for icmp request message #17674
Open
+15
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
According to section 3.2.2.6 of RFC1122, An ICMP Echo Request destined to an IP broadcast or IP multicast address MAY be silently discarded.
Impact
Check src ip for icmp request message, and drop the request message if src ip is broadcast/multicast.
Testing
Set up a SIM environment, ping the SIM from the host side, and verify that normal ping can reply.
Then, write a Python script to construct a multicast/broadcast ICMP request message with the source IP address, where SIM does not respond.
`
from scapy.all import Ether, IP, ICMP, sendp
SRC_MAC = "fa:b1:d9:6d:a0:d3"
DST_MAC = "42:e1:c4:3f:48:dd"
SRC_IP = "224.0.0.1"
DST_IP = "10.0.1.2"
INTERFACE = "eth0"
def send_custom_icmp():
try:
ether_layer = Ether(src=SRC_MAC, dst=DST_MAC)
ip_layer = IP(src=SRC_IP, dst=DST_IP, ttl=64)
icmp_layer = ICMP(type=8, code=0)
full_packet = ether_layer / ip_layer / icmp_layer
if name == "main":
send_custom_icmp()
`