Commit c646dd37 authored by Ibe Van de Veire's avatar Ibe Van de Veire Committed by Carles Cufi
Browse files

net: ip: igmp: Remove too strict length check

According to RFC2236 section 2.5, the IGMP message may be longer then 8
bytes. The rest of the bytes should be ignored.

Signed-off-by: default avatarIbe Van de Veire <ibe.vandeveire@basalte.be>
parent f852c123
Loading
Loading
Loading
Loading
+15 −12
Changes for subsys/net/ip/igmp.c: 15 added lines, 12 removed lines.
Original line number Diff line number Diff line
@@ -35,6 +35,9 @@ LOG_MODULE_DECLARE(net_ipv4, CONFIG_NET_IPV4_LOG_LEVEL);
#define IGMPV3_ALLOW_NEW_SOURCES      0x05
#define IGMPV3_BLOCK_OLD_SOURCES      0x06

#define IGMPV2_PAYLOAD_MIN_LEN 8
#define IGMPV3_PAYLOAD_MIN_LEN 12

static const struct in_addr all_systems = { { { 224, 0, 0, 1 } } };
#if defined(CONFIG_NET_IPV4_IGMPV3)
static const struct in_addr igmp_multicast_addr = { { { 224, 0, 0, 22 } } };
@@ -416,29 +419,29 @@ drop:

enum net_verdict net_ipv4_igmp_input(struct net_pkt *pkt, struct net_ipv4_hdr *ip_hdr)
{
#if defined(CONFIG_NET_IPV4_IGMPV3)
	NET_PKT_DATA_ACCESS_CONTIGUOUS_DEFINE(igmpv3_access, struct net_ipv4_igmp_v3_query);
	struct net_ipv4_igmp_v3_query *igmpv3_hdr;
#endif
	int ret;
	NET_PKT_DATA_ACCESS_CONTIGUOUS_DEFINE(igmpv2_access, struct net_ipv4_igmp_v2_query);

	struct net_ipv4_igmp_v2_query *igmpv2_hdr;
	enum igmp_version version;
	int ret;
	int igmp_buf_len =
		pkt->buffer->len - (net_pkt_ip_hdr_len(pkt) + net_pkt_ipv4_opts_len(pkt));
#if defined(CONFIG_NET_IPV4_IGMPV3)
	struct net_ipv4_igmp_v3_query *igmpv3_hdr;
	enum igmp_version version;

	NET_PKT_DATA_ACCESS_CONTIGUOUS_DEFINE(igmpv3_access, struct net_ipv4_igmp_v3_query);

	/* Detect IGMP type (RFC 3376 ch 7.1) */
	if (igmp_buf_len == 8) {
	if (igmp_buf_len == IGMPV2_PAYLOAD_MIN_LEN) {
		/* IGMPv1/2 detected */
		version = IGMPV2;
	} else if (igmp_buf_len >= 12) {
	} else if (igmp_buf_len >= IGMPV3_PAYLOAD_MIN_LEN) {
		/* IGMPv3 detected */
		version = IGMPV3;
#if !defined(CONFIG_NET_IPV4_IGMPV3)
		NET_DBG("DROP: %sv3 msg received but %s support is disabled", "IGMP", "IGMP");
		return NET_DROP;
#endif
	} else {
#else
	if (igmp_buf_len < IGMPV2_PAYLOAD_MIN_LEN) {
#endif
		NET_DBG("DROP: unsupported payload length");
		return NET_DROP;
	}