[PATCH RFC net 3/5] neigh: discard lladdr bcast/null (bcast poison)
From: Marc Suñé <hidden>
Date: 2025-12-21 21:20:15
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
The current NDP implementation accepts NDP NS/NS with the
broadcast (mcast, and null) MAC addresses as src/dst lladdr, and
updates the neighbour cache for that host.
Broadcast (and Multicast, see RFC1812, section 3.3.2) and null
MAC addresses are reserved addresses and shall never be associated
with a unicast or a multicast IPv6 address.
NDP poisioning with a broadcast MAC address, especially when
poisoning a Gateway IP, has some undesired implications compared to
an NDP poisioning with a regular MAC. (see ARP bcast poison
commit for more details).
Worth mentioning that if an attacker is able to NDP poison in
a L2 segment, that in itself is probably a bigger security threat
(Man-in-middle etc.).
However, since these MACs should never be announced as SHA,
discard/drop NDP with lladdr={bcast, null}, which prevents the
broadcast NDP poisoning vector.
Signed-off-by: Marc Suñé <redacted>
---
net/ipv6/ndisc.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 59d17b6f06bf..980768a79092 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c@@ -830,6 +830,17 @@ static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb) return reason; } + /* + * Broadcast/Multicast and zero MAC addresses should + * never be announced and accepted as llsrc address (prevent + * NDP BCAST MAC poisoning attack). + */ + if (dev->addr_len == ETH_ALEN && + (is_broadcast_ether_addr(lladdr) || + is_zero_ether_addr(lladdr))) { + return reason; + } + /* RFC2461 7.1.1: * If the IP source address is the unspecified address, * there MUST NOT be source link-layer address option
@@ -1033,6 +1044,17 @@ static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb) net_dbg_ratelimited("NA: invalid link-layer address length\n"); return reason; } + + /* + * Broadcast/Multicast and zero MAC addresses should + * never be announced and accepted as llsrc address (prevent + * NDP BCAST MAC poisoning attack). + */ + if (dev->addr_len == ETH_ALEN && + (is_broadcast_ether_addr(lladdr) || + is_zero_ether_addr(lladdr))) { + return reason; + } } ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); if (ifp) {
--
2.47.3