diff options
| author | Michael Brown | 2020-10-14 15:05:03 +0200 |
|---|---|---|
| committer | Michael Brown | 2020-10-14 15:18:49 +0200 |
| commit | 388d657080d5088ab7832fcb0ec71a9a50c3a59f (patch) | |
| tree | b8485c92a107952fb0c1953cc6a034eb844a2607 /src | |
| parent | [lacp] Detect and ignore erroneously looped back LACP packets (diff) | |
| download | ipxe-388d657080d5088ab7832fcb0ec71a9a50c3a59f.tar.gz ipxe-388d657080d5088ab7832fcb0ec71a9a50c3a59f.tar.xz ipxe-388d657080d5088ab7832fcb0ec71a9a50c3a59f.zip | |
[lacp] Ignore (and do not echo) trailing padding on received packets
The LACP responder reuses the received I/O buffer to construct the
response LACP (or marker) packet. Any received padding will therefore
be unintentionally included within the response.
Truncate the received I/O buffer to the expected length (which is
already defined in a way to allow for future protocol expansion)
before reusing it to construct the response.
Reported-by: Tore Anderson <tore@fud.no>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/net/eth_slow.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/net/eth_slow.c b/src/net/eth_slow.c index fa7a6e361..1103a49f3 100644 --- a/src/net/eth_slow.c +++ b/src/net/eth_slow.c @@ -286,6 +286,9 @@ static int eth_slow_rx ( struct io_buffer *iobuf, return -EINVAL; } + /* Strip any trailing padding */ + iob_unput ( iobuf, ( sizeof ( *eth_slow ) - iob_len ( iobuf ) ) ); + /* Handle according to subtype */ switch ( eth_slow->header.subtype ) { case ETH_SLOW_SUBTYPE_LACP: |