From f1d5eae643cdf537ef357f10f2da8ff83bdf32b4 Mon Sep 17 00:00:00 2001 From: Guus Sliepen Date: Sat, 25 Feb 2012 21:46:18 +0100 Subject: [PATCH 1/2] Don't send ICMP Time Exceeded messages for other Time Exceeded messages. That would be silly. --- src/route.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/route.c b/src/route.c index 0b77bd4a..b2e1b7bd 100644 --- a/src/route.c +++ b/src/route.c @@ -82,13 +82,14 @@ static bool ratelimit(int frequency) { static int count = 0; if(lasttime == now) { - if(++count > frequency) + if(count >= frequency) return true; } else { lasttime = now; count = 0; } + count++; return false; } @@ -858,7 +859,8 @@ static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) { return false; if(packet->data[22] < 1) { - route_ipv4_unreachable(source, packet, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL); + if(packet->data[25] != IPPROTO_ICMP || packet->data[46] != ICMP_TIME_EXCEEDED) + route_ipv4_unreachable(source, packet, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL); return false; } @@ -880,7 +882,8 @@ static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) { return false; if(packet->data[21] < 1) { - route_ipv6_unreachable(source, packet, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT); + if(packet->data[20] != IPPROTO_ICMPV6 || packet->data[54] != ICMP6_TIME_EXCEEDED) + route_ipv6_unreachable(source, packet, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT); return false; } From 5140656de6bcfda72951a7827b05414ce306e3ca Mon Sep 17 00:00:00 2001 From: Guus Sliepen Date: Sat, 25 Feb 2012 22:11:30 +0100 Subject: [PATCH 2/2] Stricter checks against routing loops. If a packet that had to be sent via an intermediate hop, and that intermediate hop was the one that sent the packet, we drop it. --- src/route.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/route.c b/src/route.c index b2e1b7bd..666f48f6 100644 --- a/src/route.c +++ b/src/route.c @@ -400,6 +400,11 @@ static void route_ipv4_unicast(node_t *source, vpn_packet_t *packet) { packet->priority = packet->data[15]; via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via; + + if(via == source) { + ifdebug(TRAFFIC) logger(LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname); + return; + } if(directonly && subnet->owner != via) return route_ipv4_unreachable(source, packet, ICMP_DEST_UNREACH, ICMP_NET_ANO); @@ -552,6 +557,11 @@ static void route_ipv6_unicast(node_t *source, vpn_packet_t *packet) { via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via; + if(via == source) { + ifdebug(TRAFFIC) logger(LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname); + return; + } + if(directonly && subnet->owner != via) return route_ipv6_unreachable(source, packet, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);