• Duan Jiong's avatar
    ipv6:introduce function to find route for redirect · b55b76b2
    Duan Jiong authored
    RFC 4861 says that the IP source address of the Redirect is the
    same as the current first-hop router for the specified ICMP
    Destination Address, so the gateway should be taken into
    consideration when we find the route for redirect.
    
    There was once a check in commit
    a6279458 ("NDISC: Search over
    all possible rules on receipt of redirect.") and the check
    went away in commit b94f1c09
    ("ipv6: Use icmpv6_notify() to propagate redirect, instead of
    rt6_redirect()").
    
    The bug is only "exploitable" on layer-2 because the source
    address of the redirect is checked to be a valid link-local
    address but it makes spoofing a lot easier in the same L2
    domain nonetheless.
    
    Thanks very much for Hannes's help.
    Signed-off-by: default avatarDuan Jiong <duanj.fnst@cn.fujitsu.com>
    Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b55b76b2
ndisc.c 42 KB