From 959e41473f2179850578482052fb73b913bc4e42 Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Wed, 14 May 2014 03:13:09 +0200 Subject: [PATCH] slirp/arp: do not special-case bogus IP addresses Do not special-case addresses with zero host part, as we do not necessarily know how big it is, and the guest can fake them anyway. Silently avoid having 0.0.0.0 as a destination, however. Signed-off-by: Samuel Thibault [Edgar: Minor change to subject] Reviewed-by: Edgar E. Iglesias Signed-off-by: Edgar E. Iglesias --- slirp/arp_table.c | 10 +--------- slirp/slirp.c | 5 +++++ 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/slirp/arp_table.c b/slirp/arp_table.c index ecdb0baee4..bcaeb44860 100644 --- a/slirp/arp_table.c +++ b/slirp/arp_table.c @@ -37,12 +37,7 @@ void arp_table_add(Slirp *slirp, uint32_t ip_addr, uint8_t ethaddr[ETH_ALEN]) ethaddr[0], ethaddr[1], ethaddr[2], ethaddr[3], ethaddr[4], ethaddr[5])); - /* Check 0.0.0.0/8 invalid source-only addresses */ - if ((ip_addr & htonl(~(0xfU << 28))) == 0) { - return; - } - - if (ip_addr == 0xffffffff || ip_addr == broadcast_addr) { + if (ip_addr == 0 || ip_addr == 0xffffffff || ip_addr == broadcast_addr) { /* Do not register broadcast addresses */ return; } @@ -73,9 +68,6 @@ bool arp_table_search(Slirp *slirp, uint32_t ip_addr, DEBUG_CALL("arp_table_search"); DEBUG_ARG("ip = 0x%x", ip_addr); - /* Check 0.0.0.0/8 invalid source-only addresses */ - assert((ip_addr & htonl(~(0xfU << 28))) != 0); - /* If broadcast address */ if (ip_addr == 0xffffffff || ip_addr == broadcast_addr) { /* return Ethernet broadcast address */ diff --git a/slirp/slirp.c b/slirp/slirp.c index 3fb48a4921..60280361e6 100644 --- a/slirp/slirp.c +++ b/slirp/slirp.c @@ -778,6 +778,11 @@ int if_encap(Slirp *slirp, struct mbuf *ifm) return 1; } + if (iph->ip_dst.s_addr == 0) { + /* 0.0.0.0 can not be a destination address, something went wrong, + * avoid making it worse */ + return 1; + } if (!arp_table_search(slirp, iph->ip_dst.s_addr, ethaddr)) { uint8_t arp_req[ETH_HLEN + sizeof(struct arphdr)]; struct ethhdr *reh = (struct ethhdr *)arp_req;