Attachment #403678 for bug #549966




	
	/* Make sure its the right packet for us, and that it passes sanity checks */
	if (packet.ip.protocol != IPPROTO_UDP || packet.ip.version != IPVERSION ||
	    packet.ip.ihl != sizeof(packet.ip) >> 2 || packet.udp.uh_dport != htons(CLIENT_PORT) ||
	    bytes > (int) sizeof(struct udp_dhcp_packet) ||
	    ntohs(packet.udp.uh_ulen) != (short) (bytes - sizeof(packet.ip))) {
	    	DEBUG(LOG_INFO, "unrelated/bogus packet");
	    	return -1;
	}

	/* verify the UDP checksum by replacing the header with a psuedo header */
	source = packet.ip.saddr;
	dest = packet.ip.daddr;
	check = packet.udp.uh_sum;
	packet.udp.uh_sum = 0;
	memset(&packet.ip, 0, sizeof(packet.ip));

	packet.ip.protocol = IPPROTO_UDP;
	packet.ip.saddr = source;
	packet.ip.daddr = dest;
	packet.ip.tot_len = packet.udp.uh_ulen; /* cheat on the psuedo-header */
	if (check && check != checksum(&packet, bytes)) {
		DEBUG(LOG_ERR, "packet with bad UDP checksum received, ignoring");
		return -1;

Lines 4-9 Link Here

(-)ppp-2.4.7.orig/pppd/plugins/dhcp/dhcpd.h (+1 lines)
4		4
5	#include <netinet/ip.h>	5	#include <netinet/ip.h>
6	#include <netinet/udp.h>	6	#include <netinet/udp.h>
		7	#include <sys/types.h>
7		8
8	#include "leases.h"	9	#include "leases.h"
9		10

Return to bug 549966

Lines 205-213 Link Here

(-)ppp-2.4.7.orig/pppd/plugins/dhcp/clientpacket.c (-5 / +5 lines)
205		205
206	/* Make sure its the right packet for us, and that it passes sanity checks */	206	/* Make sure its the right packet for us, and that it passes sanity checks */
207	if (packet.ip.protocol != IPPROTO_UDP \|\| packet.ip.version != IPVERSION \|\|	207	if (packet.ip.protocol != IPPROTO_UDP \|\| packet.ip.version != IPVERSION \|\|
208	packet.ip.ihl != sizeof(packet.ip) >> 2 \|\| packet.udp.dest != htons(CLIENT_PORT) \|\|	208	packet.ip.ihl != sizeof(packet.ip) >> 2 \|\| packet.udp.uh_dport != htons(CLIENT_PORT) \|\|
209	bytes > (int) sizeof(struct udp_dhcp_packet) \|\|	209	bytes > (int) sizeof(struct udp_dhcp_packet) \|\|
210	ntohs(packet.udp.len) != (short) (bytes - sizeof(packet.ip))) {	210	ntohs(packet.udp.uh_ulen) != (short) (bytes - sizeof(packet.ip))) {
211	DEBUG(LOG_INFO, "unrelated/bogus packet");	211	DEBUG(LOG_INFO, "unrelated/bogus packet");
212	return -1;	212	return -1;
213	}	213	}
Lines 223-236 Link Here
223	/* verify the UDP checksum by replacing the header with a psuedo header */	223	/* verify the UDP checksum by replacing the header with a psuedo header */
224	source = packet.ip.saddr;	224	source = packet.ip.saddr;
225	dest = packet.ip.daddr;	225	dest = packet.ip.daddr;
226	check = packet.udp.check;	226	check = packet.udp.uh_sum;
227	packet.udp.check = 0;	227	packet.udp.uh_sum = 0;
228	memset(&packet.ip, 0, sizeof(packet.ip));	228	memset(&packet.ip, 0, sizeof(packet.ip));
229		229
230	packet.ip.protocol = IPPROTO_UDP;	230	packet.ip.protocol = IPPROTO_UDP;
231	packet.ip.saddr = source;	231	packet.ip.saddr = source;
232	packet.ip.daddr = dest;	232	packet.ip.daddr = dest;
233	packet.ip.tot_len = packet.udp.len; /* cheat on the psuedo-header */	233	packet.ip.tot_len = packet.udp.uh_ulen; /* cheat on the psuedo-header */
234	if (check && check != checksum(&packet, bytes)) {	234	if (check && check != checksum(&packet, bytes)) {
235	DEBUG(LOG_ERR, "packet with bad UDP checksum received, ignoring");	235	DEBUG(LOG_ERR, "packet with bad UDP checksum received, ignoring");
236	return -1;	236	return -1;