Message ID | 52217A8D.9010008@cn.fujitsu.com |
---|---|
State | Superseded, archived |
Delegated to: | David Miller |
Headers | show |
On Sat, Aug 31, 2013 at 01:09:33PM +0800, Duan Jiong wrote: > RFC 4861 says that the IP source address of the Redirect is the > same as the current first-hop router for the specified ICMP > Destination Address, so the gateway should be taken into > consideration when we find the route for redirect. > > Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> This patch looks good! Maybe you could also point to commit a6279458c534d01ccc39498aba61c93083ee0372 ("NDISC: Search over all possible rules on receipt of redirect.") and where the check went away? The bug is only "exploitable" on layer-2 because the source address of the redirect is checked to be a valid link-local address but it makes spoofing a lot easier in the same L2 domain nonetheless. Nice work! Some smaller comments inline: > --- > Changes for v3: > 1.Fix the comments style problems > > net/ipv6/ah6.c | 2 +- > net/ipv6/esp6.c | 2 +- > net/ipv6/icmp.c | 2 +- > net/ipv6/ipcomp6.c | 2 +- > net/ipv6/ndisc.c | 3 ++- > net/ipv6/route.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++++----- > 6 files changed, 78 insertions(+), 11 deletions(-) > > diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c > index bb02e17..73784c3 100644 > --- a/net/ipv6/ah6.c > +++ b/net/ipv6/ah6.c > @@ -628,7 +628,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, > return; > > if (type == NDISC_REDIRECT) > - ip6_redirect(skb, net, 0, 0); > + ip6_redirect(skb, net, skb->dev->ifindex, 0); > else > ip6_update_pmtu(skb, net, info, 0, 0); > xfrm_state_put(x); > diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c > index aeac0dc..d3618a7 100644 > --- a/net/ipv6/esp6.c > +++ b/net/ipv6/esp6.c > @@ -447,7 +447,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, > return; > > if (type == NDISC_REDIRECT) > - ip6_redirect(skb, net, 0, 0); > + ip6_redirect(skb, net, skb->dev->ifindex, 0); > else > ip6_update_pmtu(skb, net, info, 0, 0); > xfrm_state_put(x); > diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c > index 7cfc8d2..73681c2 100644 > --- a/net/ipv6/icmp.c > +++ b/net/ipv6/icmp.c > @@ -92,7 +92,7 @@ static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, > if (type == ICMPV6_PKT_TOOBIG) > ip6_update_pmtu(skb, net, info, 0, 0); > else if (type == NDISC_REDIRECT) > - ip6_redirect(skb, net, 0, 0); > + ip6_redirect(skb, net, skb->dev->ifindex, 0); > > if (!(type & ICMPV6_INFOMSG_MASK)) > if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST) > diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c > index 7af5aee..5636a91 100644 > --- a/net/ipv6/ipcomp6.c > +++ b/net/ipv6/ipcomp6.c > @@ -76,7 +76,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, > return; > > if (type == NDISC_REDIRECT) > - ip6_redirect(skb, net, 0, 0); > + ip6_redirect(skb, net, skb->dev->ifindex, 0); > else > ip6_update_pmtu(skb, net, info, 0, 0); > xfrm_state_put(x); > diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c > index 04d31c2..90f474b 100644 > --- a/net/ipv6/ndisc.c > +++ b/net/ipv6/ndisc.c > @@ -1370,7 +1370,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb) > return; > > if (!ndopts.nd_opts_rh) { > - ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0); > + ip6_redirect_no_header(skb, dev_net(skb->dev), > + skb->dev->ifindex, 0); This is not indented correctly. skb->dev->ifindex should be placed right below the upper skb variable. > return; > } > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index 8d9a93e..2e1d378 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -1157,6 +1157,74 @@ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu) > } > EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu); > > +/* Handle redirects */ > +struct ip6rd_flowi { > + struct flowi6 fl6; > + struct in6_addr gateway; > +}; > + > +static struct rt6_info *__ip6_route_redirect(struct net *net, > + struct fib6_table *table, > + struct flowi6 *fl6, > + int flags) > +{ > + struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6; > + struct rt6_info *rt; > + struct fib6_node *fn; > + > + /* Get the "current" route for this destination and > + * check if the redirect has come from approriate router. > + * > + * RFC 4861 specifies that redirects should only be > + * accepted if they come from the nexthop to the target. > + * Due to the way the routes are chosen, this notion > + * is a bit fuzzy and one might need to check all possible > + * routes. > + */ > + > + read_lock_bh(&table->tb6_lock); > + fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr); > +restart: > + for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) { > + if (rt6_check_expired(rt)) > + continue; [1] (backreference for a comment below) > + if (!(rt->rt6i_flags & RTF_GATEWAY)) > + continue; > + if (fl6->flowi6_oif != rt->dst.dev->ifindex) > + continue; > + if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway)) > + continue; > + break; > + } > + > + if (!rt) > + rt = net->ipv6.ip6_null_entry; > + BACKTRACK(net, &fl6->saddr); > +out: > + dst_hold(&rt->dst); > + > + read_unlock_bh(&table->tb6_lock); > + > + return rt; > +}; > + > +static struct dst_entry *ip6_route_redirect(const struct flowi6 *fl6, > + const struct in6_addr *gateway, > + struct net *net) The ordering of the arguments could be in the same style as the other ip6_route_* functions (net, flow, gateway). But that is not that important. > +{ > + int flags = RT6_LOOKUP_F_HAS_SADDR; > + struct ip6rd_flowi rdfl; > + > + rdfl.fl6 = *fl6; > + rdfl.gateway = *gateway; > + > + if (rt6_need_strict(&fl6->daddr)) > + flags |= RT6_LOOKUP_F_IFACE; This is not needed because you do the matching on interfaces yourself in __ip6_route_redirect. The flag should currently not be checked on this code path down in fib6_rule_lookup. > + > + return fib6_rule_lookup(net, &rdfl.fl6, > + flags, __ip6_route_redirect); This line jumped a bit too far to the right, too. ;) > +} > + > void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) Maybe we should rename oif to iif now? > { > const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data; > @@ -1171,9 +1239,8 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) > fl6.saddr = iph->saddr; > fl6.flowlabel = ip6_flowinfo(iph); > > - dst = ip6_route_output(net, NULL, &fl6); > - if (!dst->error) > - rt6_do_redirect(dst, NULL, skb); > + dst = ip6_route_redirect(&fl6, &ipv6_hdr(skb)->saddr, net); > + rt6_do_redirect(dst, NULL, skb); What is the reason you left out the dst.error check? E.g. if a system had a prohbit rule it is possible to circumvent this with a redirect packet now. I would think about placing this check at [1] and fail the lookup early. rt6_do_redirect does check for null-entry, so you could omit the check here, then. > dst_release(dst); > } > EXPORT_SYMBOL_GPL(ip6_redirect); > @@ -1193,9 +1260,8 @@ void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif, > fl6.daddr = msg->dest; > fl6.saddr = iph->daddr; > > - dst = ip6_route_output(net, NULL, &fl6); > - if (!dst->error) > - rt6_do_redirect(dst, NULL, skb); > + dst = ip6_route_redirect(&fl6, &iph->saddr, net); > + rt6_do_redirect(dst, NULL, skb); Likewise. > dst_release(dst); > } Thanks, Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
于 2013年09月02日 05:08, Hannes Frederic Sowa 写道: > On Sat, Aug 31, 2013 at 01:09:33PM +0800, Duan Jiong wrote: >> RFC 4861 says that the IP source address of the Redirect is the >> same as the current first-hop router for the specified ICMP >> Destination Address, so the gateway should be taken into >> consideration when we find the route for redirect. >> >> Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> > > This patch looks good! > > Maybe you could also point to commit > a6279458c534d01ccc39498aba61c93083ee0372 ("NDISC: Search over all possible > rules on receipt of redirect.") and where the check went away? > > The bug is only "exploitable" on layer-2 because the source address of the > redirect is checked to be a valid link-local address but it makes spoofing a > lot easier in the same L2 domain nonetheless. > > Nice work! > > Some smaller comments inline: > Thanks very much for you comments, and i will correct those problems. >> --- >> Changes for v3: >> 1.Fix the comments style problems >> >> net/ipv6/ah6.c | 2 +- >> net/ipv6/esp6.c | 2 +- >> net/ipv6/icmp.c | 2 +- >> net/ipv6/ipcomp6.c | 2 +- >> net/ipv6/ndisc.c | 3 ++- >> net/ipv6/route.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++++----- >> 6 files changed, 78 insertions(+), 11 deletions(-) >> >> diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c >> index bb02e17..73784c3 100644 >> --- a/net/ipv6/ah6.c >> +++ b/net/ipv6/ah6.c >> @@ -628,7 +628,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, >> return; >> >> if (type == NDISC_REDIRECT) >> - ip6_redirect(skb, net, 0, 0); >> + ip6_redirect(skb, net, skb->dev->ifindex, 0); >> else >> ip6_update_pmtu(skb, net, info, 0, 0); >> xfrm_state_put(x); >> diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c >> index aeac0dc..d3618a7 100644 >> --- a/net/ipv6/esp6.c >> +++ b/net/ipv6/esp6.c >> @@ -447,7 +447,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, >> return; >> >> if (type == NDISC_REDIRECT) >> - ip6_redirect(skb, net, 0, 0); >> + ip6_redirect(skb, net, skb->dev->ifindex, 0); >> else >> ip6_update_pmtu(skb, net, info, 0, 0); >> xfrm_state_put(x); >> diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c >> index 7cfc8d2..73681c2 100644 >> --- a/net/ipv6/icmp.c >> +++ b/net/ipv6/icmp.c >> @@ -92,7 +92,7 @@ static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, >> if (type == ICMPV6_PKT_TOOBIG) >> ip6_update_pmtu(skb, net, info, 0, 0); >> else if (type == NDISC_REDIRECT) >> - ip6_redirect(skb, net, 0, 0); >> + ip6_redirect(skb, net, skb->dev->ifindex, 0); >> >> if (!(type & ICMPV6_INFOMSG_MASK)) >> if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST) >> diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c >> index 7af5aee..5636a91 100644 >> --- a/net/ipv6/ipcomp6.c >> +++ b/net/ipv6/ipcomp6.c >> @@ -76,7 +76,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, >> return; >> >> if (type == NDISC_REDIRECT) >> - ip6_redirect(skb, net, 0, 0); >> + ip6_redirect(skb, net, skb->dev->ifindex, 0); >> else >> ip6_update_pmtu(skb, net, info, 0, 0); >> xfrm_state_put(x); >> diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c >> index 04d31c2..90f474b 100644 >> --- a/net/ipv6/ndisc.c >> +++ b/net/ipv6/ndisc.c >> @@ -1370,7 +1370,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb) >> return; >> >> if (!ndopts.nd_opts_rh) { >> - ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0); >> + ip6_redirect_no_header(skb, dev_net(skb->dev), >> + skb->dev->ifindex, 0); > > This is not indented correctly. skb->dev->ifindex should be placed right below > the upper skb variable. > >> return; >> } >> >> diff --git a/net/ipv6/route.c b/net/ipv6/route.c >> index 8d9a93e..2e1d378 100644 >> --- a/net/ipv6/route.c >> +++ b/net/ipv6/route.c >> @@ -1157,6 +1157,74 @@ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu) >> } >> EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu); >> >> +/* Handle redirects */ >> +struct ip6rd_flowi { >> + struct flowi6 fl6; >> + struct in6_addr gateway; >> +}; >> + >> +static struct rt6_info *__ip6_route_redirect(struct net *net, >> + struct fib6_table *table, >> + struct flowi6 *fl6, >> + int flags) >> +{ >> + struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6; >> + struct rt6_info *rt; >> + struct fib6_node *fn; >> + >> + /* Get the "current" route for this destination and >> + * check if the redirect has come from approriate router. >> + * >> + * RFC 4861 specifies that redirects should only be >> + * accepted if they come from the nexthop to the target. >> + * Due to the way the routes are chosen, this notion >> + * is a bit fuzzy and one might need to check all possible >> + * routes. >> + */ >> + >> + read_lock_bh(&table->tb6_lock); >> + fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr); >> +restart: >> + for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) { >> + if (rt6_check_expired(rt)) >> + continue; > > [1] (backreference for a comment below) > >> + if (!(rt->rt6i_flags & RTF_GATEWAY)) >> + continue; >> + if (fl6->flowi6_oif != rt->dst.dev->ifindex) >> + continue; >> + if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway)) >> + continue; >> + break; >> + } >> + >> + if (!rt) >> + rt = net->ipv6.ip6_null_entry; >> + BACKTRACK(net, &fl6->saddr); >> +out: >> + dst_hold(&rt->dst); >> + >> + read_unlock_bh(&table->tb6_lock); >> + >> + return rt; >> +}; >> + >> +static struct dst_entry *ip6_route_redirect(const struct flowi6 *fl6, >> + const struct in6_addr *gateway, >> + struct net *net) > > The ordering of the arguments could be in the same style as the other > ip6_route_* functions (net, flow, gateway). But that is not that important. > >> +{ >> + int flags = RT6_LOOKUP_F_HAS_SADDR; >> + struct ip6rd_flowi rdfl; >> + >> + rdfl.fl6 = *fl6; >> + rdfl.gateway = *gateway; >> + >> + if (rt6_need_strict(&fl6->daddr)) >> + flags |= RT6_LOOKUP_F_IFACE; > > This is not needed because you do the matching on interfaces yourself > in __ip6_route_redirect. The flag should currently not be checked on > this code path down in fib6_rule_lookup. > >> + >> + return fib6_rule_lookup(net, &rdfl.fl6, >> + flags, __ip6_route_redirect); > > This line jumped a bit too far to the right, too. ;) > >> +} >> + >> void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) > > Maybe we should rename oif to iif now? Yes, that looks no ambiguity. > >> { >> const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data; >> @@ -1171,9 +1239,8 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) >> fl6.saddr = iph->saddr; >> fl6.flowlabel = ip6_flowinfo(iph); >> >> - dst = ip6_route_output(net, NULL, &fl6); >> - if (!dst->error) >> - rt6_do_redirect(dst, NULL, skb); >> + dst = ip6_route_redirect(&fl6, &ipv6_hdr(skb)->saddr, net); >> + rt6_do_redirect(dst, NULL, skb); > > What is the reason you left out the dst.error check? E.g. if a system had a > prohbit rule it is possible to circumvent this with a redirect packet now. > That's my fault. i just understand the meaning of dst.error incorrectly, and i will modify the patch according to your comment below. > I would think about placing this check at [1] and fail the lookup > early. rt6_do_redirect does check for null-entry, so you could omit the > check here, then. > Thanks, Duan -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
于 2013年09月02日 10:38, Duan Jiong 写道: >>> void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) >> >> Maybe we should rename oif to iif now? > Yes, that looks no ambiguity. I'm sorry about that. I finally think that there is no need to rename oif to iif, because the argument oif will be assigned to fl6.flowi6_oif, and if we rename it, others will be confused by this. Thanks, Duan -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c index bb02e17..73784c3 100644 --- a/net/ipv6/ah6.c +++ b/net/ipv6/ah6.c @@ -628,7 +628,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, return; if (type == NDISC_REDIRECT) - ip6_redirect(skb, net, 0, 0); + ip6_redirect(skb, net, skb->dev->ifindex, 0); else ip6_update_pmtu(skb, net, info, 0, 0); xfrm_state_put(x); diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index aeac0dc..d3618a7 100644 --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c @@ -447,7 +447,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, return; if (type == NDISC_REDIRECT) - ip6_redirect(skb, net, 0, 0); + ip6_redirect(skb, net, skb->dev->ifindex, 0); else ip6_update_pmtu(skb, net, info, 0, 0); xfrm_state_put(x); diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index 7cfc8d2..73681c2 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -92,7 +92,7 @@ static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (type == ICMPV6_PKT_TOOBIG) ip6_update_pmtu(skb, net, info, 0, 0); else if (type == NDISC_REDIRECT) - ip6_redirect(skb, net, 0, 0); + ip6_redirect(skb, net, skb->dev->ifindex, 0); if (!(type & ICMPV6_INFOMSG_MASK)) if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST) diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c index 7af5aee..5636a91 100644 --- a/net/ipv6/ipcomp6.c +++ b/net/ipv6/ipcomp6.c @@ -76,7 +76,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, return; if (type == NDISC_REDIRECT) - ip6_redirect(skb, net, 0, 0); + ip6_redirect(skb, net, skb->dev->ifindex, 0); else ip6_update_pmtu(skb, net, info, 0, 0); xfrm_state_put(x); diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 04d31c2..90f474b 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -1370,7 +1370,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb) return; if (!ndopts.nd_opts_rh) { - ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0); + ip6_redirect_no_header(skb, dev_net(skb->dev), + skb->dev->ifindex, 0); return; } diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8d9a93e..2e1d378 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1157,6 +1157,74 @@ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu) } EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu); +/* Handle redirects */ +struct ip6rd_flowi { + struct flowi6 fl6; + struct in6_addr gateway; +}; + +static struct rt6_info *__ip6_route_redirect(struct net *net, + struct fib6_table *table, + struct flowi6 *fl6, + int flags) +{ + struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6; + struct rt6_info *rt; + struct fib6_node *fn; + + /* Get the "current" route for this destination and + * check if the redirect has come from approriate router. + * + * RFC 4861 specifies that redirects should only be + * accepted if they come from the nexthop to the target. + * Due to the way the routes are chosen, this notion + * is a bit fuzzy and one might need to check all possible + * routes. + */ + + read_lock_bh(&table->tb6_lock); + fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr); +restart: + for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) { + if (rt6_check_expired(rt)) + continue; + if (!(rt->rt6i_flags & RTF_GATEWAY)) + continue; + if (fl6->flowi6_oif != rt->dst.dev->ifindex) + continue; + if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway)) + continue; + break; + } + + if (!rt) + rt = net->ipv6.ip6_null_entry; + BACKTRACK(net, &fl6->saddr); +out: + dst_hold(&rt->dst); + + read_unlock_bh(&table->tb6_lock); + + return rt; +}; + +static struct dst_entry *ip6_route_redirect(const struct flowi6 *fl6, + const struct in6_addr *gateway, + struct net *net) +{ + int flags = RT6_LOOKUP_F_HAS_SADDR; + struct ip6rd_flowi rdfl; + + rdfl.fl6 = *fl6; + rdfl.gateway = *gateway; + + if (rt6_need_strict(&fl6->daddr)) + flags |= RT6_LOOKUP_F_IFACE; + + return fib6_rule_lookup(net, &rdfl.fl6, + flags, __ip6_route_redirect); +} + void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) { const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data; @@ -1171,9 +1239,8 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark) fl6.saddr = iph->saddr; fl6.flowlabel = ip6_flowinfo(iph); - dst = ip6_route_output(net, NULL, &fl6); - if (!dst->error) - rt6_do_redirect(dst, NULL, skb); + dst = ip6_route_redirect(&fl6, &ipv6_hdr(skb)->saddr, net); + rt6_do_redirect(dst, NULL, skb); dst_release(dst); } EXPORT_SYMBOL_GPL(ip6_redirect); @@ -1193,9 +1260,8 @@ void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif, fl6.daddr = msg->dest; fl6.saddr = iph->daddr; - dst = ip6_route_output(net, NULL, &fl6); - if (!dst->error) - rt6_do_redirect(dst, NULL, skb); + dst = ip6_route_redirect(&fl6, &iph->saddr, net); + rt6_do_redirect(dst, NULL, skb); dst_release(dst); }
RFC 4861 says that the IP source address of the Redirect is the same as the current first-hop router for the specified ICMP Destination Address, so the gateway should be taken into consideration when we find the route for redirect. Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> --- Changes for v3: 1.Fix the comments style problems net/ipv6/ah6.c | 2 +- net/ipv6/esp6.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ipcomp6.c | 2 +- net/ipv6/ndisc.c | 3 ++- net/ipv6/route.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++++----- 6 files changed, 78 insertions(+), 11 deletions(-)