[PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface

[PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface

[Chas Williams III]

Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a 

From: "D.S. Ljungmark" <ljungmark@modio.se>

A local route may have a lower hop_limit set than global routes do.

RFC 3756, Section 4.2.7, "Parameter Spoofing"

>   1.  The attacker includes a Current Hop Limit of one or another small
>       number which the attacker knows will cause legitimate packets to
>       be dropped before they reach their destination.

>   As an example, one possible approach to mitigate this threat is to
>   ignore very small hop limits.  The nodes could implement a
>   configurable minimum hop limit, and ignore attempts to set it below
>   said limit.

Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/ipv6/ndisc.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 09a22f4..bcd6518 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1193,7 +1193,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 	if (rt)
 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
 	if (ra_msg->icmph.icmp6_hop_limit) {
-		in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+		/* Only set hop_limit on the interface if it is higher than
+		 * the current hop_limit.
+		 */
+		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+		} else {
+			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+		}
 		if (rt)
 			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
 				       ra_msg->icmph.icmp6_hop_limit);
-- 
1.9.1

Re: [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface

[Greg KH]

On Tue, Apr 28, 2015 at 01:51:51PM -0600, Chas Williams III wrote:
> Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a 
> 
> From: "D.S. Ljungmark" <ljungmark@modio.se>
> 
> A local route may have a lower hop_limit set than global routes do.
> 
> RFC 3756, Section 4.2.7, "Parameter Spoofing"
> 
> >   1.  The attacker includes a Current Hop Limit of one or another small
> >       number which the attacker knows will cause legitimate packets to
> >       be dropped before they reach their destination.
> 
> >   As an example, one possible approach to mitigate this threat is to
> >   ignore very small hop limits.  The nodes could implement a
> >   configurable minimum hop limit, and ignore attempts to set it below
> >   said limit.
> 
> Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> ---
>  net/ipv6/ndisc.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

Why have you sent this, when your name isn't on the commit at all?

What do you want done with this?

Have you read Documentation/stable_kernel_rules.txt?

confused,

greg k-h

Re: [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface

[Chas Williams III]

On Tue, 2015-04-28 at 14:01 -0600, Greg KH wrote:
> On Tue, Apr 28, 2015 at 01:51:51PM -0600, Chas Williams III wrote:
> > Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a 
> > 
> > From: "D.S. Ljungmark" <ljungmark@modio.se>
> > 
> > A local route may have a lower hop_limit set than global routes do.
> > 
> > RFC 3756, Section 4.2.7, "Parameter Spoofing"
> > 
> > >   1.  The attacker includes a Current Hop Limit of one or another small
> > >       number which the attacker knows will cause legitimate packets to
> > >       be dropped before they reach their destination.
> > 
> > >   As an example, one possible approach to mitigate this threat is to
> > >   ignore very small hop limits.  The nodes could implement a
> > >   configurable minimum hop limit, and ignore attempts to set it below
> > >   said limit.
> > 
> > Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
> > Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> > Signed-off-by: David S. Miller <davem@davemloft.net>
> > ---
> >  net/ipv6/ndisc.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> Why have you sent this, when your name isn't on the commit at all?
> 
> What do you want done with this?
> 
> Have you read Documentation/stable_kernel_rules.txt?
> 
> confused,
> 
> greg k-h

I didn't write the patch so my name isn't on it but I would like it
applied to the 3.14.y stable kernel.  I was trying to follow Option #2
from the documentation -- I guess I didn't get it right.

Re: [PATCH 3.14.y] ipv6: Don't reduce hop limit for an interface

[Greg KH]

On Tue, Apr 28, 2015 at 02:12:16PM -0600, Chas Williams III wrote:
> On Tue, 2015-04-28 at 14:01 -0600, Greg KH wrote:
> > On Tue, Apr 28, 2015 at 01:51:51PM -0600, Chas Williams III wrote:
> > > Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a 
> > > 
> > > From: "D.S. Ljungmark" <ljungmark@modio.se>
> > > 
> > > A local route may have a lower hop_limit set than global routes do.
> > > 
> > > RFC 3756, Section 4.2.7, "Parameter Spoofing"
> > > 
> > > >   1.  The attacker includes a Current Hop Limit of one or another small
> > > >       number which the attacker knows will cause legitimate packets to
> > > >       be dropped before they reach their destination.
> > > 
> > > >   As an example, one possible approach to mitigate this threat is to
> > > >   ignore very small hop limits.  The nodes could implement a
> > > >   configurable minimum hop limit, and ignore attempts to set it below
> > > >   said limit.
> > > 
> > > Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
> > > Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> > > Signed-off-by: David S. Miller <davem@davemloft.net>
> > > ---
> > >  net/ipv6/ndisc.c | 9 ++++++++-
> > >  1 file changed, 8 insertions(+), 1 deletion(-)
> > 
> > Why have you sent this, when your name isn't on the commit at all?
> > 
> > What do you want done with this?
> > 
> > Have you read Documentation/stable_kernel_rules.txt?
> > 
> > confused,
> > 
> > greg k-h
> 
> I didn't write the patch so my name isn't on it but I would like it
> applied to the 3.14.y stable kernel.  I was trying to follow Option #2
> from the documentation -- I guess I didn't get it right.

Read the section above Option 1 for networking patches, the workflow
there is different.

thanks,

greg k-h