NetBSD-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
kern/42243: "net.inet.icmp.bmcastecho" support
>Number: 42243
>Category: kern
>Synopsis: "net.inet.icmp.bmcastecho" support
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: change-request
>Submitter-Id: net
>Arrival-Date: Wed Oct 28 14:30:00 +0000 2009
>Originator: yasuoka%iij.ad.jp@localhost
>Release: NetBSD current
>Organization:
Internet Initiative Japan Inc.
>Environment:
System: NetBSD yasuoka-nb-c.iij.ad.jp 5.99.21 NetBSD 5.99.21 (GENERIC) #4: Wed
Oct 28 21:33:24 JST 2009
yasuoka%yasuoka-nb-c.iij.ad.jp@localhost:/source/yasuoka/NetBSD/current/sys/arch/i386/compile/obj/GENERIC
i386
Architecture: i386
Machine: i386
>Description:
As "CERT Advisory CA-1998-01 Smurf IP Denial-of-Service Attacks"
http://www.cert.org/advisories/CA-1998-01.html ,
| III. Solution
| A. Solutions for the Intermediary
(snip)
| 2. Configure your operating system to prevent the machine from
| responding to ICMP packets sent to IP broadcast addresses.
The advisory has been issued 11 years ago, but NetBSD still responds
to broadcast ICMP packets.
A patch is attached at ">Fix:" section, I hope NetBSD applies this
patch to fix the issue.
- The patch came from FreeBSD.
- It disables responding ICMP echo or timestamp request to the
broadcast.
- This behavior can be changed by the sysctl
net.inet.icmp.bmcastecho
- netstat(1) shows the packet count that are dropped by this issue.
>How-To-Repeat:
Ping to your local IP network's all 0 broadcast, NetBSD hosts respond
the ping.
For example,
|------+-------------+-----------| local network (192.168.0.0/24)
|.101 |.102
+----+-----+ +----+-----+
| NetBSD-A | | NetBSD-B |
+----------+ +----------+
- NetBSD-A has 192.168.0.101/24
- NetBSD-B has 192.168.0.102/24
- On NetBSD-A, ping to 192.168.0.0
=> NetBSD-B answers the ping.
>Fix:
Apply following patch. The patch is for NetBSD-current 2009-10-28.
Index: sys/netinet/icmp_var.h
===================================================================
RCS file: /cvsroot/NetBSD/src/sys/netinet/icmp_var.h,v
retrieving revision 1.27
diff -b -u -p -r1.27 icmp_var.h
--- sys/netinet/icmp_var.h 12 Apr 2008 05:58:22 -0000 1.27
+++ sys/netinet/icmp_var.h 28 Oct 2009 12:57:35 -0000
@@ -57,7 +57,10 @@
/* space for ICMP_MAXTYPE + 1 (19) counters */
#define ICMP_STAT_PMTUCHG 46 /* path MTU changes */
-#define ICMP_NSTATS 47
+#define ICMP_STAT_BMCASTECHO 47 /* b/mcast echo requests
dropped */
+#define ICMP_STAT_BMCASTTSTAMP 48 /* b/mcast tstamp requests
dropped */
+
+#define ICMP_NSTATS 49
#if ICMP_MAXTYPE != 18
#error ICMP_MAXTYPE too large for ICMP statistics
@@ -75,7 +78,8 @@
#define ICMPCTL_REDIRACCEPT 5 /* Accept redirects from routers */
#define ICMPCTL_REDIRTIMEOUT 6 /* Remove routes added via redirects */
#define ICMPCTL_STATS 7 /* ICMP statistics */
-#define ICMPCTL_MAXID 8
+#define ICMPCTL_BMCASTECHO 8 /* allow broad/mult-cast echo */
+#define ICMPCTL_MAXID 9
#define ICMPCTL_NAMES { \
{ 0, 0 }, \
@@ -86,6 +90,7 @@
{ "rediraccept", CTLTYPE_INT }, \
{ "redirtimeout", CTLTYPE_INT }, \
{ "stats", CTLTYPE_STRUCT }, \
+ { "bmcastecho", CTLTYPE_INT }, \
}
#ifdef _KERNEL
Index: sys/netinet/ip_icmp.c
===================================================================
RCS file: /cvsroot/NetBSD/src/sys/netinet/ip_icmp.c,v
retrieving revision 1.121
diff -b -u -p -r1.121 ip_icmp.c
--- sys/netinet/ip_icmp.c 16 Sep 2009 15:23:05 -0000 1.121
+++ sys/netinet/ip_icmp.c 28 Oct 2009 12:57:35 -0000
@@ -142,6 +142,7 @@ __KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v
*/
int icmpmaskrepl = 0;
+int icmpbmcastecho = 0;
#ifdef ICMPPRINTFS
int icmpprintfs = 0;
#endif
@@ -542,6 +543,11 @@ icmp_input(struct mbuf *m, ...)
break;
case ICMP_ECHO:
+ if (!icmpbmcastecho &&
+ (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
+ ICMP_STATINC(ICMP_STAT_BMCASTECHO);
+ break;
+ }
icp->icmp_type = ICMP_ECHOREPLY;
goto reflect;
@@ -550,6 +556,11 @@ icmp_input(struct mbuf *m, ...)
ICMP_STATINC(ICMP_STAT_BADLEN);
break;
}
+ if (!icmpbmcastecho &&
+ (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
+ ICMP_STATINC(ICMP_STAT_BMCASTTSTAMP);
+ break;
+ }
icp->icmp_type = ICMP_TSTAMPREPLY;
icp->icmp_rtime = iptime();
icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
@@ -1055,6 +1066,14 @@ sysctl_netinet_icmp_setup(struct sysctll
sysctl_net_inet_icmp_stats, 0, NULL, 0,
CTL_NET, PF_INET, IPPROTO_ICMP, ICMPCTL_STATS,
CTL_EOL);
+ sysctl_createv(clog, 0, NULL, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "bmcastecho",
+ SYSCTL_DESCR("Respond to ICMP_ECHO or ICMP_TIMESTAMP "
+ "message to the broadcast or multicast"),
+ NULL, 0, &icmpbmcastecho, 0,
+ CTL_NET, PF_INET, IPPROTO_ICMP, ICMPCTL_BMCASTECHO,
+ CTL_EOL);
}
void
Index: usr.bin/netstat/inet.c
===================================================================
RCS file: /cvsroot/NetBSD/src/usr.bin/netstat/inet.c,v
retrieving revision 1.91
diff -b -u -p -r1.91 inet.c
--- usr.bin/netstat/inet.c 14 Sep 2009 10:36:50 -0000 1.91
+++ usr.bin/netstat/inet.c 28 Oct 2009 12:57:35 -0000
@@ -582,6 +582,8 @@ icmp_stats(u_long off, const char *name)
p(ICMP_STAT_TOOSHORT, "\t%llu message%s < minimum length\n");
p(ICMP_STAT_CHECKSUM, "\t%llu bad checksum%s\n");
p(ICMP_STAT_BADLEN, "\t%llu message%s with bad length\n");
+ p(ICMP_STAT_BMCASTECHO, "\t%llu multicast echo request%s ignored\n");
+ p(ICMP_STAT_BMCASTTSTAMP, "\t%llu multicast timestamp request%s
ignored\n");
for (first = 1, i = 0; i < ICMP_MAXTYPE + 1; i++)
if (icmpstat[ICMP_STAT_INHIST + i] != 0) {
if (first) {
Index: share/man/man7/sysctl.7
===================================================================
RCS file: /cvsroot/NetBSD/src/share/man/man7/sysctl.7,v
retrieving revision 1.27
diff -b -u -p -r1.27 sysctl.7
--- share/man/man7/sysctl.7 5 Oct 2009 10:47:52 -0000 1.27
+++ share/man/man7/sysctl.7 28 Oct 2009 12:57:35 -0000
@@ -983,6 +983,7 @@ The currently defined protocols and name
.It icmp maskrepl integer yes
.It icmp rediraccept integer yes
.It icmp redirtimeout integer yes
+.It icmp bmcastecho integer yes
.It ip allowsrcrt integer yes
.It ip anonportmax integer yes
.It ip anonportmin integer yes
@@ -1192,6 +1193,9 @@ ICMP redirect.
This defaults to 600 seconds.
.It Li icmp.returndatabytes
Number of bytes to return in an ICMP error message.
+.It Li icmp.bmcastecho
+If set to 1, enables responding to ICMP echo or timestamp request to the
+broadcast address.
.It Li tcp.ack_on_push
If set to 1, TCP is to immediately transmit an ACK upon reception of
a packet with PUSH set.
>Unformatted:
Home |
Main Index |
Thread Index |
Old Index