ipv6: Don't reduce hop limit for an interface

1. The attacker includes a Current Hop Limit of one or another small number which the attacker knows will cause legitimate packets to be dropped before they reach their destination.

As an example, one possible approach to mitigate this threat is to ignore very small hop limits. The nodes could implement a configurable minimum hop limit, and ignore attempts to set it below said limit.

From 3ae93eb68a06ab2d9c984c6708dbc9e5f3bc8251 Mon Sep 17 00:00:00 2001
From: "D.S. Ljungmark" <[email protected]>
Date: Wed, 25 Mar 2015 09:28:15 +0100
Subject: [PATCH] ipv6: Don't reduce hop limit for an interface

A local route may have a lower hop_limit set than global routes do.

RFC 3756, Section 4.2.7, "Parameter Spoofing"

Quoted 8 lines

1. The attacker includes a Current Hop Limit of one or another small number which the attacker knows will cause legitimate packets to be dropped before they reach their destination.

As an example, one possible approach to mitigate this threat is to ignore very small hop limits. The nodes could implement a configurable minimum hop limit, and ignore attempts to set it below said limit.

Signed-off-by D.S. Ljungmark <[email protected]>

---
 net/ipv6/ndisc.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

net/ipv6/ndisc.c +1 -1

index 471ed24..14ecdaf 100644
@@ -1218,7 +1218,14 @@ static void ndisc_router_discovery(struct sk_buff
 *skb)
 	if (rt)
 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
 	if (ra_msg->icmph.icmp6_hop_limit) {
-               in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+               /* Only set hop_limit on the interface if it is higher

than

net/ipv6/ndisc.c +3 -0

+                * the current hop_limit.
+                */
+               if (in6_dev->cnf.hop_limit <

ra_msg->icmph.icmp6_hop_limit) {
+ in6_dev->cnf.hop_limit =
ra_msg->icmph.icmp6_hop_limit;

net/ipv6/ndisc.c +2 -0

+               } else {
+                       ND_PRINTK(2, warn, "RA: Got route advertisement

with lower hop_limit than current\n");
+ }

From 3ae93eb68a06ab2d9c984c6708dbc9e5f3bc8251 Mon Sep 17 00:00:00 2001
From: "D.S. Ljungmark" <[email protected]>
Date: Wed, 25 Mar 2015 09:28:15 +0100
Subject: [PATCH] ipv6: Don't reduce hop limit for an interface

A local route may have a lower hop_limit set than global routes do.

RFC 3756, Section 4.2.7, "Parameter Spoofing"

Quoted 3 lines

1. The attacker includes a Current Hop Limit of one or another small number which the attacker knows will cause legitimate packets to be dropped before they reach their destination.

Quoted 4 lines

As an example, one possible approach to mitigate this threat is to ignore very small hop limits. The nodes could implement a configurable minimum hop limit, and ignore attempts to set it below said limit.

Signed-off-by D.S. Ljungmark <[email protected]>