ipv4: icmp: do not process ICMP_EXT_ECHOREPLY for broadcast/multicast addresses
authorEric Dumazet <edumazet@google.com>
Wed, 26 Feb 2025 18:34:36 +0000 (18:34 +0000)
committerJakub Kicinski <kuba@kernel.org>
Fri, 28 Feb 2025 22:41:33 +0000 (14:41 -0800)
There is no point processing ICMP_EXT_ECHOREPLY for routes
which would drop ICMP_ECHOREPLY (RFC 1122 3.2.2.6, 3.2.2.8)

This seems an oversight of the initial implementation.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250226183437.1457318-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv4/icmp.c

index 799775ba97d4f1bad1f070fb2a2596650df177af..058d4c1e300d0c0be7a04fd67e8e39924dfcd2cc 100644 (file)
@@ -1248,22 +1248,6 @@ int icmp_rcv(struct sk_buff *skb)
                goto reason_check;
        }
 
-       if (icmph->type == ICMP_EXT_ECHOREPLY) {
-               reason = ping_rcv(skb);
-               goto reason_check;
-       }
-
-       /*
-        *      18 is the highest 'known' ICMP type. Anything else is a mystery
-        *
-        *      RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
-        *                discarded.
-        */
-       if (icmph->type > NR_ICMP_TYPES) {
-               reason = SKB_DROP_REASON_UNHANDLED_PROTO;
-               goto error;
-       }
-
        /*
         *      Parse the ICMP message
         */
@@ -1290,6 +1274,22 @@ int icmp_rcv(struct sk_buff *skb)
                }
        }
 
+       if (icmph->type == ICMP_EXT_ECHOREPLY) {
+               reason = ping_rcv(skb);
+               goto reason_check;
+       }
+
+       /*
+        *      18 is the highest 'known' ICMP type. Anything else is a mystery
+        *
+        *      RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
+        *                discarded.
+        */
+       if (icmph->type > NR_ICMP_TYPES) {
+               reason = SKB_DROP_REASON_UNHANDLED_PROTO;
+               goto error;
+       }
+
        reason = icmp_pointers[icmph->type].handler(skb);
 reason_check:
        if (!reason)  {