diff mbox

[U-Boot,1/2] net: reject Bootp/DHCP packets with bad OP value

Message ID 14903f1f-3b4e-487c-b598-66c7b8cad21f@HUB1.rwth-ad.de
State Accepted
Delegated to: Joe Hershberger
Headers show

Commit Message

Stefan Brüns Aug. 27, 2015, 9:53 p.m. UTC 
Rename check_packet to check_reply_packet to make its function more
obvious.
The check for DHCP_* values is completely off, as it should
compare against DHCP option 53 (Message Type). Only valid value for
any Bootp/DHCP reply is BOOTREPLY.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
---
 net/bootp.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

Comments

Joe Hershberger Sept. 3, 2015, 9:43 p.m. UTC | #1 
Hi Stefan,

On Thu, Aug 27, 2015 at 4:53 PM, Stefan Brüns
<stefan.bruens@rwth-aachen.de> wrote:
> Rename check_packet to check_reply_packet to make its function more
> obvious.
> The check for DHCP_* values is completely off, as it should
> compare against DHCP option 53 (Message Type). Only valid value for
> any Bootp/DHCP reply is BOOTREPLY.
>
> Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>

Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Joe Hershberger Oct. 29, 2015, 7:25 p.m. UTC | #2 
On Thu, Aug 27, 2015 at 4:53 PM, Stefan Brüns
<stefan.bruens@rwth-aachen.de> wrote:
> Rename check_packet to check_reply_packet to make its function more
> obvious.
> The check for DHCP_* values is completely off, as it should
> compare against DHCP option 53 (Message Type). Only valid value for
> any Bootp/DHCP reply is BOOTREPLY.
>
> Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>

Applied to u-boot-net/master, thanks!
-Joe
diff mbox

Patch

diff --git a/net/bootp.c b/net/bootp.c
index 43466af..e6eba12 100644
--- a/net/bootp.c
+++ b/net/bootp.c
@@ -109,7 +109,8 @@  static bool bootp_match_id(ulong id)
 	return false;
 }
 
-static int check_packet(uchar *pkt, unsigned dest, unsigned src, unsigned len)
+static int check_reply_packet(uchar *pkt, unsigned dest, unsigned src,
+			      unsigned len)
 {
 	struct bootp_hdr *bp = (struct bootp_hdr *)pkt;
 	int retval = 0;
@@ -118,11 +119,7 @@  static int check_packet(uchar *pkt, unsigned dest, unsigned src, unsigned len)
 		retval = -1;
 	else if (len < sizeof(struct bootp_hdr) - OPT_FIELD_SIZE)
 		retval = -2;
-	else if (bp->bp_op != OP_BOOTREQUEST &&
-			bp->bp_op != OP_BOOTREPLY &&
-			bp->bp_op != DHCP_OFFER &&
-			bp->bp_op != DHCP_ACK &&
-			bp->bp_op != DHCP_NAK)
+	else if (bp->bp_op != OP_BOOTREPLY)
 		retval = -3;
 	else if (bp->bp_htype != HWT_ETHER)
 		retval = -4;
@@ -343,7 +340,7 @@  static void bootp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
 	bp = (struct bootp_hdr *)pkt;
 
 	/* Filter out pkts we don't want */
-	if (check_packet(pkt, dest, src, len))
+	if (check_reply_packet(pkt, dest, src, len))
 		return;
 
 	/*
@@ -958,7 +955,7 @@  static void dhcp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
 	      src, dest, len, dhcp_state);
 
 	/* Filter out pkts we don't want */
-	if (check_packet(pkt, dest, src, len))
+	if (check_reply_packet(pkt, dest, src, len))
 		return;
 
 	debug("DHCPHandler: got DHCP packet: (src=%d, dst=%d, len=%d) state: "