tree 409d559655c589239ec14ca1621042d730141f8b
parent 4076b12ee93e13fc60c59cf92068588489a96608
author David van Moolenbroek <david@minix3.org> 1479839811 +0000
committer sg <goldsimon@gmx.de> 1479844296 +0100

ipv4/ipv6: restrict loopback-destined traffic

Generally speaking, packets with a loopback destination address -
127.0.0.1 for IPv4 and ::1 for IPv6 - should not be accepted on
non-loopback interfaces.  For IPv4, this is implied by RFC 1122
Sec. 3.2.1.3.  For IPv6, it is mandated by RFC 4291 Sec. 2.5.3.
Failure to perform this filtering may have security implications, as
applications that bind sockets to loopback addresses may not expect
that nodes on the local external network be able to produce traffic
that will arrive at such sockets.

With this patch, lwIP drops packets that are sent to a loopback
address but do not originate from the interface that has the loopback
address assigned to it.  This approach works regardless of whether it
is lwIP or the system using it that implements a loopback netif.  The
only exception that must be made is for configurations that enable
netif packet loopback but disable the lwIP loopback netif: in that
case, loopback packets are routed across non-loopback netifs and would
thus be lost by the new filter as well.

For IPv6, loopback-destined packets are also no longer forwarded; the
IPv4 forwarding code already had a check for that.

As a small performance improvement, the IPv6 link-local/loopback
address check is now performed only once per packet rather than
repeatedly for every candidate netif.