[Bridge] [PATCHv2 1/2] bridge: multicast: add sanity check for general query destination
David Miller
davem at davemloft.net
Wed Mar 12 03:23:25 UTC 2014
From: Linus Lüssing <linus.luessing at web.de>
Date: Mon, 10 Mar 2014 22:25:24 +0100
> General IGMP and MLD queries are supposed to have the multicast
> link-local all-nodes address as their destination according to RFC2236
> section 9, RFC3376 section 4.1.12/9.1, RFC2710 section 8 and RFC3810
> section 5.1.15.
>
> Without this check, such malformed IGMP/MLD queries can result in a
> denial of service: The queries are ignored by most IGMP/MLD listeners
> therefore they will not respond with an IGMP/MLD report. However,
> without this patch these malformed MLD queries would enable the
> snooping part in the bridge code, potentially shutting down the
> according ports towards these hosts for multicast traffic as the
> bridge did not learn about these listeners.
>
> Reported-by: Jan Stancek <jstancek at redhat.com>
> Signed-off-by: Linus Lüssing <linus.luessing at web.de>
Applied.
More information about the Bridge
mailing list