netdev - Re: [PATCH RFC net 1/5] arp: discard sha bcast/null (bcast ARP poison)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4ab8135d-75b8-4aa0-b5ce-f917e4a34e18@linux.dev>
Date: Mon, 22 Dec 2025 09:47:24 +0000
From: Vadim Fedorenko <vadim.fedorenko@...ux.dev>
To: Marc Suñé <marcdevel@...il.com>, kuba@...nel.org,
 willemdebruijn.kernel@...il.com, pabeni@...hat.com
Cc: netdev@...r.kernel.org, dborkman@...nel.org
Subject: Re: [PATCH RFC net 1/5] arp: discard sha bcast/null (bcast ARP
 poison)

On 21/12/2025 21:19, Marc SuÃ±Ã© wrote:
>   
>   /*
> + *	For Ethernet devices, Broadcast/Multicast and zero MAC addresses should
> + *	never be announced and accepted as sender HW address (prevent BCAST MAC
> + *	and NULL ARP poisoning attack).
> + */
> +	if (dev->addr_len == ETH_ALEN &&

dev_type == ARPHRD_ETHER ?

> +	    (is_broadcast_ether_addr(sha) || is_zero_ether_addr(sha)))

RFC says that neither broadcast, nor multicast must be believed. You
check for broadcast only. The better check would be:

!is_unicast_ether_addr(sha)

> +		goto out_free_skb;
> +
> + /*
>    *     Special case: We must set Frame Relay source Q.922 address
>    */
>   	if (dev_type == ARPHRD_DLCI)