summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid L Stevens <dlstevens@us.ibm.com>2007-05-23 00:55:49 +0200
committerAdrian Bunk <bunk@stusta.de>2007-05-23 00:55:49 +0200
commita36aa221e62ffce68819f97844494c2d5f86d011 (patch)
treee997eb1a75f63b09f72d3db91530ce02614a535e
parentbba669f7618ba72c6b17faed7c6ca6c6bec8cb72 (diff)
downloadlwn-a36aa221e62ffce68819f97844494c2d5f86d011.tar.gz
lwn-a36aa221e62ffce68819f97844494c2d5f86d011.zip
[IPV6]: Send ICMPv6 error on scope violations.
When an IPv6 router is forwarding a packet with a link-local scope source address off-link, RFC 4007 requires it to send an ICMPv6 destination unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
-rw-r--r--net/ipv6/ip6_output.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5bf70b1442ea..638dc8c48ef6 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -391,10 +391,17 @@ int ip6_forward(struct sk_buff *skb)
*/
if (xrlim_allow(dst, 1*HZ))
ndisc_send_redirect(skb, n, target);
- } else if (ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK
- |IPV6_ADDR_LINKLOCAL)) {
+ } else {
+ int addrtype = ipv6_addr_type(&hdr->saddr);
+
/* This check is security critical. */
- goto error;
+ if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
+ goto error;
+ if (addrtype & IPV6_ADDR_LINKLOCAL) {
+ icmpv6_send(skb, ICMPV6_DEST_UNREACH,
+ ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
+ goto error;
+ }
}
if (skb->len > dst_mtu(dst)) {