* [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface
@ 2015-04-28 19:51 Chas Williams III
2015-04-28 20:01 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Chas Williams III @ 2015-04-28 19:51 UTC (permalink / raw)
To: stable
Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a
From: "D.S. Ljungmark" <ljungmark@modio.se>
A local route may have a lower hop_limit set than global routes do.
RFC 3756, Section 4.2.7, "Parameter Spoofing"
> 1. The attacker includes a Current Hop Limit of one or another small
> number which the attacker knows will cause legitimate packets to
> be dropped before they reach their destination.
> As an example, one possible approach to mitigate this threat is to
> ignore very small hop limits. The nodes could implement a
> configurable minimum hop limit, and ignore attempts to set it below
> said limit.
Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/ipv6/ndisc.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 09a22f4..bcd6518 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1193,7 +1193,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (rt)
rt6_set_expires(rt, jiffies + (HZ * lifetime));
if (ra_msg->icmph.icmp6_hop_limit) {
- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ /* Only set hop_limit on the interface if it is higher than
+ * the current hop_limit.
+ */
+ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ } else {
+ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+ }
if (rt)
dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
ra_msg->icmph.icmp6_hop_limit);
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface
2015-04-28 19:51 [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface Chas Williams III
@ 2015-04-28 20:01 ` Greg KH
2015-04-28 20:12 ` Chas Williams III
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2015-04-28 20:01 UTC (permalink / raw)
To: Chas Williams III; +Cc: stable
On Tue, Apr 28, 2015 at 01:51:51PM -0600, Chas Williams III wrote:
> Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a
>
> From: "D.S. Ljungmark" <ljungmark@modio.se>
>
> A local route may have a lower hop_limit set than global routes do.
>
> RFC 3756, Section 4.2.7, "Parameter Spoofing"
>
> > 1. The attacker includes a Current Hop Limit of one or another small
> > number which the attacker knows will cause legitimate packets to
> > be dropped before they reach their destination.
>
> > As an example, one possible approach to mitigate this threat is to
> > ignore very small hop limits. The nodes could implement a
> > configurable minimum hop limit, and ignore attempts to set it below
> > said limit.
>
> Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> ---
> net/ipv6/ndisc.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
Why have you sent this, when your name isn't on the commit at all?
What do you want done with this?
Have you read Documentation/stable_kernel_rules.txt?
confused,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface
2015-04-28 20:01 ` Greg KH
@ 2015-04-28 20:12 ` Chas Williams III
2015-04-28 21:02 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Chas Williams III @ 2015-04-28 20:12 UTC (permalink / raw)
To: Greg KH; +Cc: Chas Williams III, stable
On Tue, 2015-04-28 at 14:01 -0600, Greg KH wrote:
> On Tue, Apr 28, 2015 at 01:51:51PM -0600, Chas Williams III wrote:
> > Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a
> >
> > From: "D.S. Ljungmark" <ljungmark@modio.se>
> >
> > A local route may have a lower hop_limit set than global routes do.
> >
> > RFC 3756, Section 4.2.7, "Parameter Spoofing"
> >
> > > 1. The attacker includes a Current Hop Limit of one or another small
> > > number which the attacker knows will cause legitimate packets to
> > > be dropped before they reach their destination.
> >
> > > As an example, one possible approach to mitigate this threat is to
> > > ignore very small hop limits. The nodes could implement a
> > > configurable minimum hop limit, and ignore attempts to set it below
> > > said limit.
> >
> > Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
> > Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> > Signed-off-by: David S. Miller <davem@davemloft.net>
> > ---
> > net/ipv6/ndisc.c | 9 ++++++++-
> > 1 file changed, 8 insertions(+), 1 deletion(-)
>
> Why have you sent this, when your name isn't on the commit at all?
>
> What do you want done with this?
>
> Have you read Documentation/stable_kernel_rules.txt?
>
> confused,
>
> greg k-h
I didn't write the patch so my name isn't on it but I would like it
applied to the 3.14.y stable kernel. I was trying to follow Option #2
from the documentation -- I guess I didn't get it right.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface
2015-04-28 20:12 ` Chas Williams III
@ 2015-04-28 21:02 ` Greg KH
0 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2015-04-28 21:02 UTC (permalink / raw)
To: Chas Williams III; +Cc: stable
On Tue, Apr 28, 2015 at 02:12:16PM -0600, Chas Williams III wrote:
> On Tue, 2015-04-28 at 14:01 -0600, Greg KH wrote:
> > On Tue, Apr 28, 2015 at 01:51:51PM -0600, Chas Williams III wrote:
> > > Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a
> > >
> > > From: "D.S. Ljungmark" <ljungmark@modio.se>
> > >
> > > A local route may have a lower hop_limit set than global routes do.
> > >
> > > RFC 3756, Section 4.2.7, "Parameter Spoofing"
> > >
> > > > 1. The attacker includes a Current Hop Limit of one or another small
> > > > number which the attacker knows will cause legitimate packets to
> > > > be dropped before they reach their destination.
> > >
> > > > As an example, one possible approach to mitigate this threat is to
> > > > ignore very small hop limits. The nodes could implement a
> > > > configurable minimum hop limit, and ignore attempts to set it below
> > > > said limit.
> > >
> > > Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
> > > Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> > > Signed-off-by: David S. Miller <davem@davemloft.net>
> > > ---
> > > net/ipv6/ndisc.c | 9 ++++++++-
> > > 1 file changed, 8 insertions(+), 1 deletion(-)
> >
> > Why have you sent this, when your name isn't on the commit at all?
> >
> > What do you want done with this?
> >
> > Have you read Documentation/stable_kernel_rules.txt?
> >
> > confused,
> >
> > greg k-h
>
> I didn't write the patch so my name isn't on it but I would like it
> applied to the 3.14.y stable kernel. I was trying to follow Option #2
> from the documentation -- I guess I didn't get it right.
Read the section above Option 1 for networking patches, the workflow
there is different.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-04-28 21:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-04-28 19:51 [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface Chas Williams III
2015-04-28 20:01 ` Greg KH
2015-04-28 20:12 ` Chas Williams III
2015-04-28 21:02 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.