[lwip-devel] [patch #9170] ipv4/ipv6: restrict loopback-destined traffic

[David van Moolenbroek]

URL:
  <http://savannah.nongnu.org/patch/?9170>

                 Summary: ipv4/ipv6: restrict loopback-destined traffic
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: dcvmoole
            Submitted on: Tue 22 Nov 2016 07:10:59 PM GMT
                Category: None
                Priority: 5 - Normal
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None

    _______________________________________________________

Details:

For your consideration. Commit message reproduced below. While the same check
could be implemented with input hooks, I believe that from a "security by
default" point of view it makes sense to implement this in lwIP itself. FWIW,
I have verified (pre+post) that at least on my configuration, the patch indeed
has the intended effect. As a bit of background, for one example (which
admittedly I found with a google search) of why this is relevant for security,
see
https://googleprojectzero.blogspot.nl/2015/01/finding-and-exploiting-ntpd.html