diff options
| author | Zhenlei Huang <zlei.huang@gmail.com> | 2021-05-18 20:51:37 +0000 |
|---|---|---|
| committer | Lutz Donnerhacke <donner@FreeBSD.org> | 2021-05-18 20:59:46 +0000 |
| commit | 3d846e48227e2e78c1e7b35145f57353ffda56ba (patch) | |
| tree | bcc5931084700f562956afd78d33bdb0a5c8ec82 /sys/netinet | |
| parent | 63b6a08ce2467b8e230e7a4ecb3e1ddf1b48851c (diff) | |
| download | src-3d846e48227e2e78c1e7b35145f57353ffda56ba.tar.gz src-3d846e48227e2e78c1e7b35145f57353ffda56ba.zip | |
Do not forward datagrams originated by link-local addresses
The current implement of ip_input() reject packets destined for
169.254.0.0/16, but not those original from 169.254.0.0/16 link-local
addresses.
Fix to fully respect RFC 3927 section 2.7.
PR: 255388
Reviewed by: donner, rgrimes, karels
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D29968
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/ip_input.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 43d375c2385f..1139e3a5abfa 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -738,15 +738,10 @@ passin: } ia = NULL; } - /* RFC 3927 2.7: Do not forward datagrams for 169.254.0.0/16. */ - if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) { - IPSTAT_INC(ips_cantforward); - m_freem(m); - return; - } if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { MROUTER_RLOCK(); - if (V_ip_mrouter) { + /* Do not forward packets from IN_LINKLOCAL. */ + if (V_ip_mrouter && !IN_LINKLOCAL(ntohl(ip->ip_src.s_addr))) { /* * If we are acting as a multicast router, all * incoming multicast packets are passed to the @@ -785,6 +780,13 @@ passin: goto ours; if (ip->ip_dst.s_addr == INADDR_ANY) goto ours; + /* Do not forward packets to or from IN_LINKLOCAL. */ + if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) || + IN_LINKLOCAL(ntohl(ip->ip_src.s_addr))) { + IPSTAT_INC(ips_cantforward); + m_freem(m); + return; + } /* * Not for us; forward if possible and desirable. |