Re: ipv6 : Don't reduce hop limit below current value

["D. S. Ljungmark" <spider@takeit.se>]

[-- Attachment #1.1: Type: text/plain, Size: 1185 bytes --]

On tis, 2015-03-24 at 18:06 -0400, David Miller wrote:
> From: "D. S. Ljungmark" <spider@takeit.se>
> Date: Tue, 24 Mar 2015 22:36:09 +0100
> 
> > +		/*	Only set hop_limit on the interface if it is higher than
> > +		*	the current hop_limit.
> > +		 */
> 
> Comments in the networking should be of the form:
> 
> 	/* Like
> 	 * this.
> 	 */

Not sure if your complaint was about the misaligned *, or that there was
a tab char after the comment start rather than a space.

Adjusted both and re-sending.



And there was a comment about quoting the relevant IETF standard,

RFC 3756, Section 4.2.7, "Parameter Spoofing"


   1.  The attacker includes a Current Hop Limit of one or another small
       number which the attacker knows will cause legitimate packets to
       be dropped before they reach their destination.
<snip>

   As an example, one possible approach to mitigate this threat is to
   ignore very small hop limits.  The nodes could implement a
   configurable minimum hop limit, and ignore attempts to set it below
   said limit.


This patch basically treats the current interface hop limit as the
threshold to use. 

//D.S.


[-- Attachment #1.2: 0001-ipv6-Don-t-reduce-hop-limit-for-an-interface.patch --]
[-- Type: text/x-patch, Size: 1253 bytes --]

From 8abb9ca595f83ae4f433dbe2b022c9e16a0cbc39 Mon Sep 17 00:00:00 2001
From: "D.S. Ljungmark" <spider@skuggor.se>
Date: Tue, 24 Mar 2015 22:18:47 +0100
Subject: [PATCH] ipv6: Don't reduce hop limit for an interface

A local route may have a lower hop_limit set than global routes do.
See RFC 3756 Section 4.2.7

Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
---
 net/ipv6/ndisc.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 471ed24..14ecdaf 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1218,7 +1218,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 	if (rt)
 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
 	if (ra_msg->icmph.icmp6_hop_limit) {
-		in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+		/* Only set hop_limit on the interface if it is higher than
+		 * the current hop_limit.
+		 */
+		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+		} else {
+			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+		}
 		if (rt)
 			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
 				       ra_msg->icmph.icmp6_hop_limit);
-- 
2.1.0


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 819 bytes --]