diff options
| author | David S. Miller <davem@davemloft.net> | 2014-07-16 14:09:34 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-07-16 14:09:34 -0700 |
| commit | 1a98c69af1ecd97bfd1f4e4539924a9192434e36 (patch) | |
| tree | a243defcf921ea174f8e43fce11d06830a6a9c36 /net/ipv6 | |
| parent | 7a575f6b907ea5d207d2b5010293c189616eae34 (diff) | |
| parent | b6603fe574af289dbe9eb9fb4c540bca04f5a053 (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/mcast.c | 13 | ||||
| -rw-r--r-- | net/ipv6/udp.c | 6 |
2 files changed, 16 insertions, 3 deletions
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 08b367c6b9c..617f0958e16 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1301,8 +1301,17 @@ int igmp6_event_query(struct sk_buff *skb) len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr); len -= skb_network_header_len(skb); - /* Drop queries with not link local source */ - if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) + /* RFC3810 6.2 + * Upon reception of an MLD message that contains a Query, the node + * checks if the source address of the message is a valid link-local + * address, if the Hop Limit is set to 1, and if the Router Alert + * option is present in the Hop-By-Hop Options header of the IPv6 + * packet. If any of these checks fails, the packet is dropped. + */ + if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL) || + ipv6_hdr(skb)->hop_limit != 1 || + !(IP6CB(skb)->flags & IP6SKB_ROUTERALERT) || + IP6CB(skb)->ra != htons(IPV6_OPT_ROUTERALERT_MLD)) return -EINVAL; idev = __in6_dev_get(skb->dev); diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index c2bd28fd43e..b4481df3d5f 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -673,8 +673,11 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) goto csum_error; } - if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) + if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) { + UDP6_INC_STATS_BH(sock_net(sk), + UDP_MIB_RCVBUFERRORS, is_udplite); goto drop; + } skb_dst_drop(skb); @@ -689,6 +692,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) bh_unlock_sock(sk); return rc; + csum_error: UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite); drop: |