The IP translation layer is using the neighbor table of the kernel to get the unicast link layer (mac) address for IP(v4|v6) addresses. The kernel can not only return unicast mac addresses to such an RTM_GETNEIGH request but also zero mac address. Such an address must be considered invalid because the global translation table may not only contain a unique client mac address entry for it. The translation from client mac to originator will therefore most likely return an unexpected originator. Dropping these kind of (bogus) results avoids confusions while using things like batctl's ping or traceroute. Reported-by: Andre Kasper <Andre.Kasper(a)gmx.de&gt; Signed-off-by: Sven Eckelmann <sven(a)narfation.org&gt; --- Cc: Andre Kasper <Andre.Kasper(a)gmx.de&gt; See https://www.open-mesh.org/issues/353 --- functions.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/functions.c b/functions.c index cd92b60..3c340a2 100644 --- a/functions.c +++ b/functions.c @@ -571,6 +571,19 @@ static struct nla_policy neigh_policy[NDA_MAX+1] = { [NDA_PROBES] = { .type = NLA_U32 }, }; +static bool ether_addr_valid(const uint8_t *addr) +{ + /* no multicast address */ + if (addr[0] & 0x01) + return false; + + /* no zero address */ + if ((addr[0] | addr[1] | addr[2] | addr[3] | addr[4] | addr[5]) == 0) + return false; + + return true; +} + static int resolve_mac_from_parse(struct nl_msg *msg, void *arg) { struct nlattr *tb[NDA_MAX + 1]; @@ -616,6 +629,9 @@ static int resolve_mac_from_parse(struct nl_msg *msg, void *arg) mac = nla_data(tb[NDA_LLADDR]); l3addr = nla_data(tb[NDA_DST]); + if (!ether_addr_valid(mac)) + goto err; + if (memcmp(nl_arg->l3addr, l3addr, l3_len) == 0) { memcpy(nl_arg->mac_result, mac, ETH_ALEN); nl_arg->found = 1; -- 2.17.0