Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5bb1ab09 authored by David L Stevens's avatar David L Stevens Committed by David S. Miller
Browse files

[IPV6]: Send ICMPv6 error on scope violations. 



When an IPv6 router is forwarding a packet with a link-local scope source
address off-link, RFC 4007 requires it to send an ICMPv6 destination
unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below.

Signed-off-by: default avatarDavid L Stevens <dlstevens@us.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ac40e41f

net/ipv6/ip6_output.c

+10 −3
Original line number Diff line number Diff line
@@ -463,10 +463,17 @@ int ip6_forward(struct sk_buff *skb) 
		 */

		if (xrlim_allow(dst, 1*HZ))

			ndisc_send_redirect(skb, n, target);

	} else if (ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK

						|IPV6_ADDR_LINKLOCAL)) {

	} else {

		int addrtype = ipv6_addr_type(&hdr->saddr);



		/* This check is security critical. */

		if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))

			goto error;

		if (addrtype & IPV6_ADDR_LINKLOCAL) {

			icmpv6_send(skb, ICMPV6_DEST_UNREACH,

				ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);

			goto error;

		}

	}



	if (skb->len > dst_mtu(dst)) {