Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7cc9150e authored by Flavio Leitner's avatar Flavio Leitner Committed by David S. Miller
Browse files

route: fix ICMP redirect validation 



The commit f39925db
(ipv4: Cache learned redirect information in inetpeer.)
removed some ICMP packet validations which are required by
RFC 1122, section 3.2.2.2:
...
  A Redirect message SHOULD be silently discarded if the new
  gateway address it specifies is not on the same connected
  (sub-) net through which the Redirect arrived [INTRO:2,
  Appendix A], or if the source of the Redirect is not the
  current first-hop gateway for the specified destination (see
  Section 3.3.1).

Signed-off-by: default avatarFlavio Leitner <fbl@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent da92b194

net/ipv4/route.c

+31 −5
Original line number Diff line number Diff line
@@ -1309,7 +1309,12 @@ static void rt_del(unsigned hash, struct rtable *rt) 
void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,

		    __be32 saddr, struct net_device *dev)

{

	int s, i;

	struct in_device *in_dev = __in_dev_get_rcu(dev);

	struct rtable *rt;

	__be32 skeys[2] = { saddr, 0 };

	int    ikeys[2] = { dev->ifindex, 0 };

	struct flowi4 fl4;

	struct inet_peer *peer;

	struct net *net;
@@ -1332,14 +1337,35 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw, 
			goto reject_redirect;

	}



	peer = inet_getpeer_v4(daddr, 1);

	if (peer) {

		peer->redirect_learned.a4 = new_gw;

	memset(&fl4, 0, sizeof(fl4));

	fl4.daddr = daddr;

	for (s = 0; s < 2; s++) {

		for (i = 0; i < 2; i++) {

			fl4.flowi4_oif = ikeys[i];

			fl4.saddr = skeys[s];

			rt = __ip_route_output_key(net, &fl4);

			if (IS_ERR(rt))

				continue;



		inet_putpeer(peer);

			if (rt->dst.error || rt->dst.dev != dev ||

			    rt->rt_gateway != old_gw) {

				ip_rt_put(rt);

				continue;

			}



			if (!rt->peer)

				rt_bind_peer(rt, rt->rt_dst, 1);



			peer = rt->peer;

			if (peer) {

				peer->redirect_learned.a4 = new_gw;

				atomic_inc(&__rt_peer_genid);

			}



			ip_rt_put(rt);

			return;

		}

	}

	return;



reject_redirect: