提交 5bb1ab09 编写于 作者: D David L Stevens 提交者: David S. Miller

[IPV6]: Send ICMPv6 error on scope violations.

When an IPv6 router is forwarding a packet with a link-local scope source
address off-link, RFC 4007 requires it to send an ICMPv6 destination
unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below.
Signed-off-by: NDavid L Stevens <dlstevens@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 ac40e41f
...@@ -463,10 +463,17 @@ int ip6_forward(struct sk_buff *skb) ...@@ -463,10 +463,17 @@ int ip6_forward(struct sk_buff *skb)
*/ */
if (xrlim_allow(dst, 1*HZ)) if (xrlim_allow(dst, 1*HZ))
ndisc_send_redirect(skb, n, target); ndisc_send_redirect(skb, n, target);
} else if (ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK } else {
|IPV6_ADDR_LINKLOCAL)) { int addrtype = ipv6_addr_type(&hdr->saddr);
/* This check is security critical. */ /* This check is security critical. */
goto error; if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
goto error;
if (addrtype & IPV6_ADDR_LINKLOCAL) {
icmpv6_send(skb, ICMPV6_DEST_UNREACH,
ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
goto error;
}
} }
if (skb->len > dst_mtu(dst)) { if (skb->len > dst_mtu(dst)) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册