diff options
| author | David L Stevens <dlstevens@us.ibm.com> | 2007-05-15 00:02:07 -0700 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2007-05-23 14:32:50 -0700 |
| commit | 131f27eac4b7b1d6d7158805c75ed7243631ef4b (patch) | |
| tree | c39d21646331bbc56df1ccaa53cefd838ea0941c /net | |
| parent | b07fee24dcefbeed5bdacb7e1b74e8423a2c20be (diff) | |
[PATCH] IPV6: Send ICMPv6 error on scope violations.
When an IPv6 router is forwarding a packet with a link-local scope source
address off-link, RFC 4007 requires it to send an ICMPv6 destination
unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below.
Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/ip6_output.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 305516921aa..9fa3ffb7226 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -449,10 +449,17 @@ int ip6_forward(struct sk_buff *skb) */ if (xrlim_allow(dst, 1*HZ)) ndisc_send_redirect(skb, n, target); - } else if (ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK - |IPV6_ADDR_LINKLOCAL)) { + } else { + int addrtype = ipv6_addr_type(&hdr->saddr); + /* This check is security critical. */ - goto error; + if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK)) + goto error; + if (addrtype & IPV6_ADDR_LINKLOCAL) { + icmpv6_send(skb, ICMPV6_DEST_UNREACH, + ICMPV6_NOT_NEIGHBOUR, 0, skb->dev); + goto error; + } } if (skb->len > dst_mtu(dst)) { |