* ipv6 : Don't reduce hop limit below current value
@ 2015-03-24 21:36 D. S. Ljungmark
2015-03-24 22:06 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: D. S. Ljungmark @ 2015-03-24 21:36 UTC (permalink / raw)
To: netdev
[-- Attachment #1.1: Type: text/plain, Size: 101 bytes --]
A local route may have a lower hop_limit set than global routes do.
See RFC 3756 Section 4.2.7
[-- Attachment #1.2: 0001-ipv6-Don-t-reduce-hop-limit-for-an-interface.patch --]
[-- Type: text/x-patch, Size: 1252 bytes --]
From 846e648ac8ea9325778a61038a09d98c2fb7002a Mon Sep 17 00:00:00 2001
From: "D.S. Ljungmark" <spider@skuggor.se>
Date: Tue, 24 Mar 2015 22:18:47 +0100
Subject: [PATCH] ipv6: Don't reduce hop limit for an interface
A local route may have a lower hop_limit set than global routes do.
See RFC 3756 Section 4.2.7
Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
---
net/ipv6/ndisc.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 471ed24..b939652 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1218,7 +1218,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (rt)
rt6_set_expires(rt, jiffies + (HZ * lifetime));
if (ra_msg->icmph.icmp6_hop_limit) {
- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ /* Only set hop_limit on the interface if it is higher than
+ * the current hop_limit.
+ */
+ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ } else {
+ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+ }
if (rt)
dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
ra_msg->icmph.icmp6_hop_limit);
--
2.1.0
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: ipv6 : Don't reduce hop limit below current value
2015-03-24 21:36 ipv6 : Don't reduce hop limit below current value D. S. Ljungmark
@ 2015-03-24 22:06 ` David Miller
2015-03-24 23:36 ` D. S. Ljungmark
0 siblings, 1 reply; 4+ messages in thread
From: David Miller @ 2015-03-24 22:06 UTC (permalink / raw)
To: ljungmark, spider; +Cc: netdev
From: "D. S. Ljungmark" <spider@takeit.se>
Date: Tue, 24 Mar 2015 22:36:09 +0100
> + /* Only set hop_limit on the interface if it is higher than
> + * the current hop_limit.
> + */
Comments in the networking should be of the form:
/* Like
* this.
*/
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ipv6 : Don't reduce hop limit below current value
2015-03-24 22:06 ` David Miller
@ 2015-03-24 23:36 ` D. S. Ljungmark
2015-03-25 1:20 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: D. S. Ljungmark @ 2015-03-24 23:36 UTC (permalink / raw)
To: David Miller; +Cc: netdev
[-- Attachment #1.1: Type: text/plain, Size: 1185 bytes --]
On tis, 2015-03-24 at 18:06 -0400, David Miller wrote:
> From: "D. S. Ljungmark" <spider@takeit.se>
> Date: Tue, 24 Mar 2015 22:36:09 +0100
>
> > + /* Only set hop_limit on the interface if it is higher than
> > + * the current hop_limit.
> > + */
>
> Comments in the networking should be of the form:
>
> /* Like
> * this.
> */
Not sure if your complaint was about the misaligned *, or that there was
a tab char after the comment start rather than a space.
Adjusted both and re-sending.
And there was a comment about quoting the relevant IETF standard,
RFC 3756, Section 4.2.7, "Parameter Spoofing"
1. The attacker includes a Current Hop Limit of one or another small
number which the attacker knows will cause legitimate packets to
be dropped before they reach their destination.
<snip>
As an example, one possible approach to mitigate this threat is to
ignore very small hop limits. The nodes could implement a
configurable minimum hop limit, and ignore attempts to set it below
said limit.
This patch basically treats the current interface hop limit as the
threshold to use.
//D.S.
[-- Attachment #1.2: 0001-ipv6-Don-t-reduce-hop-limit-for-an-interface.patch --]
[-- Type: text/x-patch, Size: 1253 bytes --]
From 8abb9ca595f83ae4f433dbe2b022c9e16a0cbc39 Mon Sep 17 00:00:00 2001
From: "D.S. Ljungmark" <spider@skuggor.se>
Date: Tue, 24 Mar 2015 22:18:47 +0100
Subject: [PATCH] ipv6: Don't reduce hop limit for an interface
A local route may have a lower hop_limit set than global routes do.
See RFC 3756 Section 4.2.7
Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
---
net/ipv6/ndisc.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 471ed24..14ecdaf 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1218,7 +1218,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (rt)
rt6_set_expires(rt, jiffies + (HZ * lifetime));
if (ra_msg->icmph.icmp6_hop_limit) {
- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ /* Only set hop_limit on the interface if it is higher than
+ * the current hop_limit.
+ */
+ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ } else {
+ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+ }
if (rt)
dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
ra_msg->icmph.icmp6_hop_limit);
--
2.1.0
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: ipv6 : Don't reduce hop limit below current value
2015-03-24 23:36 ` D. S. Ljungmark
@ 2015-03-25 1:20 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2015-03-25 1:20 UTC (permalink / raw)
To: ljungmark, spider; +Cc: netdev
From: "D. S. Ljungmark" <spider@takeit.se>
Date: Wed, 25 Mar 2015 00:36:38 +0100
> On tis, 2015-03-24 at 18:06 -0400, David Miller wrote:
>> From: "D. S. Ljungmark" <spider@takeit.se>
>> Date: Tue, 24 Mar 2015 22:36:09 +0100
>>
>> > + /* Only set hop_limit on the interface if it is higher than
>> > + * the current hop_limit.
>> > + */
>>
>> Comments in the networking should be of the form:
>>
>> /* Like
>> * this.
>> */
>
> Not sure if your complaint was about the misaligned *, or that there was
> a tab char after the comment start rather than a space.
>
> Adjusted both and re-sending.
This is not how you resubmit a patch.
When you are asked to make a change in your submission, you must
make a fresh, new, patch posting with full commit message and
Signoffs.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-03-25 1:20 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-24 21:36 ipv6 : Don't reduce hop limit below current value D. S. Ljungmark
2015-03-24 22:06 ` David Miller
2015-03-24 23:36 ` D. S. Ljungmark
2015-03-25 1:20 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.