netdev - [PATCH RFC net 3/5] neigh: discard lladdr bcast/null (bcast poison)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0a53d41598b65645ec9e0b6ee3773c6b66267142.1766349632.git.marcdevel@gmail.com>
Date: Sun, 21 Dec 2025 22:19:36 +0100
From: Marc Suñé <marcdevel@...il.com>
To: kuba@...nel.org,
	willemdebruijn.kernel@...il.com,
	pabeni@...hat.com
Cc: netdev@...r.kernel.org,
	dborkman@...nel.org,
	Marc Suñé <marcdevel@...il.com>
Subject: [PATCH RFC net 3/5] neigh: discard lladdr bcast/null (bcast poison)

The current NDP implementation accepts NDP NS/NS with the
broadcast (mcast, and null) MAC addresses as src/dst lladdr, and
updates the neighbour cache for that host.

Broadcast (and Multicast, see RFC1812, section 3.3.2) and null
MAC addresses are reserved addresses and shall never be associated
with a unicast or a multicast IPv6 address.

NDP poisioning with a broadcast MAC address, especially when
poisoning a Gateway IP, has some undesired implications compared to
an NDP poisioning with a regular MAC. (see ARP bcast poison
commit for more details).

Worth mentioning that if an attacker is able to NDP poison in
a L2 segment, that in itself is probably a bigger security threat
(Man-in-middle etc.).

However, since these MACs should never be announced as SHA,
discard/drop NDP with lladdr={bcast, null}, which prevents the
broadcast NDP poisoning vector.

Signed-off-by: Marc Suñé <marcdevel@...il.com>
---
 net/ipv6/ndisc.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 59d17b6f06bf..980768a79092 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -830,6 +830,17 @@ static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)
 			return reason;
 		}

+		/*
+		 * Broadcast/Multicast and zero MAC addresses should
+		 * never be announced and accepted as llsrc address (prevent
+		 * NDP BCAST MAC poisoning attack).
+		 */
+		if (dev->addr_len == ETH_ALEN &&
+		    (is_broadcast_ether_addr(lladdr) ||
+		     is_zero_ether_addr(lladdr))) {
+			return reason;
+		}
+
 		/* RFC2461 7.1.1:
 		 *	If the IP source address is the unspecified address,
 		 *	there MUST NOT be source link-layer address option
@@ -1033,6 +1044,17 @@ static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
 			net_dbg_ratelimited("NA: invalid link-layer address length\n");
 			return reason;
 		}
+
+		/*
+		 * Broadcast/Multicast and zero MAC addresses should
+		 * never be announced and accepted as llsrc address (prevent
+		 * NDP BCAST MAC poisoning attack).
+		 */
+		if (dev->addr_len == ETH_ALEN &&
+		    (is_broadcast_ether_addr(lladdr) ||
+		     is_zero_ether_addr(lladdr))) {
+			return reason;
+		}
 	}
 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 	if (ifp) {
-- 
2.47.3