From 9cb26fd34fcd4278c4d5ca2a4824507bcec7b851 Mon Sep 17 00:00:00 2001 From: Kevin Krakauer Date: Fri, 6 Oct 2023 14:33:34 -0700 Subject: [PATCH] netstack: verify stack supports protocol before finding route Not doing so breaks the assumption of later code that netProto is supported by the stack. PiperOrigin-RevId: 571436763 --- pkg/tcpip/stack/stack.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/tcpip/stack/stack.go b/pkg/tcpip/stack/stack.go index 382fcdd49..33b3a503e 100644 --- a/pkg/tcpip/stack/stack.go +++ b/pkg/tcpip/stack/stack.go @@ -1305,6 +1305,11 @@ func (s *Stack) FindRoute(id tcpip.NICID, localAddr, remoteAddr tcpip.Address, n s.mu.RLock() defer s.mu.RUnlock() + // Reject attempts to use unsupported protocols. + if !s.CheckNetworkProtocol(netProto) { + return nil, &tcpip.ErrUnknownProtocol{} + } + isLinkLocal := header.IsV6LinkLocalUnicastAddress(remoteAddr) || header.IsV6LinkLocalMulticastAddress(remoteAddr) isLocalBroadcast := remoteAddr == header.IPv4Broadcast isMulticast := header.IsV4MulticastAddress(remoteAddr) || header.IsV6MulticastAddress(remoteAddr)