[IPV6]: Send ICMPv6 error on scope violations.
When an IPv6 router is forwarding a packet with a link-local scope source address off-link, RFC 4007 requires it to send an ICMPv6 destination unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
ac40e41f4d
commit
5bb1ab09e4
|
@ -463,10 +463,17 @@ int ip6_forward(struct sk_buff *skb)
|
|||
*/
|
||||
if (xrlim_allow(dst, 1*HZ))
|
||||
ndisc_send_redirect(skb, n, target);
|
||||
} else if (ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK
|
||||
|IPV6_ADDR_LINKLOCAL)) {
|
||||
} else {
|
||||
int addrtype = ipv6_addr_type(&hdr->saddr);
|
||||
|
||||
/* This check is security critical. */
|
||||
goto error;
|
||||
if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
|
||||
goto error;
|
||||
if (addrtype & IPV6_ADDR_LINKLOCAL) {
|
||||
icmpv6_send(skb, ICMPV6_DEST_UNREACH,
|
||||
ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
|
||||
goto error;
|
||||
}
|
||||
}
|
||||
|
||||
if (skb->len > dst_mtu(dst)) {
|
||||
|
|
Loading…
Reference in a new issue