[Bridge] [PATCHv2 1/2] bridge: multicast: add sanity check for general query destination

David Miller davem at davemloft.net
Wed Mar 12 03:23:25 UTC 2014


From: Linus Lüssing <linus.luessing at web.de>
Date: Mon, 10 Mar 2014 22:25:24 +0100

> General IGMP and MLD queries are supposed to have the multicast
> link-local all-nodes address as their destination according to RFC2236
> section 9, RFC3376 section 4.1.12/9.1, RFC2710 section 8 and RFC3810
> section 5.1.15.
> 
> Without this check, such malformed IGMP/MLD queries can result in a
> denial of service: The queries are ignored by most IGMP/MLD listeners
> therefore they will not respond with an IGMP/MLD report. However,
> without this patch these malformed MLD queries would enable the
> snooping part in the bridge code, potentially shutting down the
> according ports towards these hosts for multicast traffic as the
> bridge did not learn about these listeners.
> 
> Reported-by: Jan Stancek <jstancek at redhat.com>
> Signed-off-by: Linus Lüssing <linus.luessing at web.de>

Applied.


More information about the Bridge mailing list