Drop incoming fe80:: packets silently now.
PATCH 1/1 Drop incoming fe80:: packets silently now.
IPv6 has the concept of "link local" addresses, fe80::<host id>, which normally are present on every link, and are used for stuff like DHCPv6, neighbor discovery, etc.
OpenVPN point-to-multipoint mode currently does neither configure them on tun interfaces, nor are they handled in a meaningful way if a client OS always has them (like Windows or Solaris) - so the log fills with many lines of "MULTI: bad source address from client [fe80::...]", serving no useful purpose.
This patch just recognizes IPv6 LL packets and silently drops them.
Further patches can build on this and add full link-local support, which would require address learning (as the addresse are based on host IDs, not assigned by the server).
--- src/openvpn/multi.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
src/openvpn/multi.c +12 -2
@@ -2161,8 +2161,18 @@ multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins/* make sure that source address is associated with this client */ else if (multi_get_instance_by_virtual_addr (m, &src, true) != m->pending) { -msg (D_MULTI_DROPPED ,"MULTI: bad source address from client [%s], packet dropped" , -mroute_addr_print (&src, &gc)); +/* IPv6 link-local address (fe80::xxx)? +*/ +if ( (src.type &MR_ADDR_MASK ) ==MR_ADDR_IPV6 && + src.addr[0 ] ==0xfe && src.addr[1 ] ==0x80 ) + { +/* do nothing, for now. TODO: add address learning */ + } +else + { +msg (D_MULTI_DROPPED ,"MULTI: bad source address from client [%s], packet dropped" , +mroute_addr_print (&src, &gc)); + } c->c2.to_tun.len =0 ; }/* client-to-client communication enabled? */
Signature · 1 line
1.8.3.2
ACK
Getting rid of useless log messages makes the important ones stand out more, which is great.
Maybe put the IPv6 link-local address comment on a single line?
-Steffan
Quoted 47 lines · Gert Doering
IPv6 has the concept of "link local" addresses, fe80::<host id>, which normally are present on every link, and are used for stuff like DHCPv6, neighbor discovery, etc.
OpenVPN point-to-multipoint mode currently does neither configure them on tun interfaces, nor are they handled in a meaningful way if a client OS always has them (like Windows or Solaris) - so the log fills with many lines of "MULTI: bad source address from client [fe80::...]", serving no useful purpose.
This patch just recognizes IPv6 LL packets and silently drops them.
Further patches can build on this and add full link-local support, which would require address learning (as the addresse are based on host IDs, not assigned by the server).
Signed-off-by Gert Doering <[email protected]...>--- src/openvpn/multi.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)src/openvpn/multi.c +12
-2@@ -2161,8 +2161,18 @@ multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins/* make sure that source address is associated with this client */ else if (multi_get_instance_by_virtual_addr (m, &src, true) != m->pending) { -msg (D_MULTI_DROPPED ,"MULTI: bad source address from client [%s], packet dropped" , -mroute_addr_print (&src, &gc)); +/* IPv6 link-local address (fe80::xxx)? +*/ +if ( (src.type &MR_ADDR_MASK ) ==MR_ADDR_IPV6 && + src.addr[0 ] ==0xfe && src.addr[1 ] ==0x80 ) + { +/* do nothing, for now. TODO: add address learning */ + } +else + { +msg (D_MULTI_DROPPED ,"MULTI: bad source address from client [%s], packet dropped" , +mroute_addr_print (&src, &gc)); + } c->c2.to_tun.len =0 ; }/* client-to-client communication enabled? */
Hi,
Quoted 1 line · Steffan Karger
Maybe put the IPv6 link-local address comment on a single line?
Yeah. That one started as a multi-line comment :-) - I'll change it to
Quoted 6 lines
src/openvpn/multi.c multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins · line 2168
Quoted 6 lines
src/openvpn/multi.c +4
-2-msg (D_MULTI_DROPPED ,"MULTI: bad source address from client [%s], packet dropped" , -mroute_addr_print (&src, &gc)); +/* IPv6 link-local address (fe80::xxx)? */ +if ( (src.type &MR_ADDR_MASK ) ==MR_ADDR_IPV6 && + src.addr[0 ] ==0xfe && src.addr[1 ] ==0x80 ) + {
... as I go.
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...Patch has been applied to the master and release/2.3 branches.
commit 70f1864188ad00451683cabf51e56b7730250c40 (master) commit 45f5a0a87870809ee453695ff0167b3754f0431e (release/2.3)
Author: Gert Doering Date: Fri Jun 6 20:43:55 2014 +0200
Drop incoming fe80:: packets silently now.
Signed-off-by: Gert Doering <[email protected]...>
Acked-by: Steffan Karger <[email protected]...>
Message-Id: <[email protected]...>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8773--
kind regards,
Gert Doering