be proactive about unspecified IPv6 source address. pcb layer uses

unspecified address (::) to mean "unbounded" or "unconnected",
and can be confused by packets from outside.

use of :: as source is not documented well in IPv6 specification.

not sure if it presents a real threat.  the worst case scenario is a DoS
against TCP listening socket:
- outsider transmit TCP SYN with :: as IPv6 source
- receiving side creates TCP control block with:
	local address = my addres
	remote address = ::	(meaning "unconnected")
	state = SYN_RCVD
  note that SYN ACK will not be sent due to ip6_output() filter.
  this stays until it timeouts.
- the TCP control block prevents listening TCP control block from
  being contacted (DoS).

1 files changed, 14 insertions, 1 deletions

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index f57471be513..2547b166ffb 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.45 2000/06/18 17:32:48 itojun Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.46 2000/07/27 04:05:27 itojun Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -290,6 +290,19 @@ udp_input(m, va_alist)
 		}
 
 		/*
+		 * Be proactive about unspecified IPv6 address in source.
+		 * As we use all-zero to indicate unbounded/unconnected pcb,
+		 * unspecified IPv6 address can be used to confuse us.
+		 *
+		 * Note that packets with unspecified IPv6 destination is
+		 * already dropped in ip6_input.
+		 */
+		if (IN6_IS_ADDR_UNSPECIFIED(&ipv6->ip6_src)) {
+			/* XXX stat */
+			goto bad;
+		}
+
+		/*
 		 * In IPv6, the UDP checksum is ALWAYS used.
 		 */
 		if ((uh->uh_sum = in6_cksum(m, IPPROTO_UDP, iphlen, len))) {