git: 7da8312f7bf0 - stable/13 - Do not forward datagrams originated by link-local addresses

[Lutz Donnerhacke]

The branch stable/13 has been updated by donner:

URL: https://cgit.FreeBSD.org/src/commit/?id=7da8312f7bf050be4fe436ea66ac46414312ae26

commit 7da8312f7bf050be4fe436ea66ac46414312ae26
Author:     Zhenlei Huang <zlei.huang at gmail.com>
AuthorDate: 2021-05-18 20:51:37 +0000
Commit:     Lutz Donnerhacke <donner at FreeBSD.org>
CommitDate: 2021-06-17 08:08:59 +0000

    Do not forward datagrams originated by link-local addresses
    
    The current implement of ip_input() reject packets destined for
    169.254.0.0/16, but not those original from 169.254.0.0/16 link-local
    addresses.
    
    Fix to fully respect RFC 3927 section 2.7.
    
    PR:             255388
    Reviewed by:    donner, rgrimes, karels
    Differential Revision:  https://reviews.freebsd.org/D29968
    Reviewed by:    rgrimes, donner, karels, marcus, emaste
    Differential Revision: https://reviews.freebsd.org/D30374
    
    (cherry picked from commit 3d846e48227e2e78c1e7b35145f57353ffda56ba)
    (cherry picked from commit 03b0505b8fe848f33f2f38fe89dd5538908c847e)
---
 sys/netinet/ip_input.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index a85f8ac7b567..57c77f29b3eb 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -736,14 +736,12 @@ passin:
 		}
 		ia = NULL;
 	}
-	/* RFC 3927 2.7: Do not forward datagrams for 169.254.0.0/16. */
-	if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) {
-		IPSTAT_INC(ips_cantforward);
-		m_freem(m);
-		return;
-	}
 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
-		if (V_ip_mrouter) {
+		/*
+		 * RFC 3927 2.7: Do not forward multicast packets from
+		 * IN_LINKLOCAL.
+		 */
+		if (V_ip_mrouter && !IN_LINKLOCAL(ntohl(ip->ip_src.s_addr))) {
 			/*
 			 * If we are acting as a multicast router, all
 			 * incoming multicast packets are passed to the
@@ -778,6 +776,13 @@ passin:
 		goto ours;
 	if (ip->ip_dst.s_addr == INADDR_ANY)
 		goto ours;
+	/* RFC 3927 2.7: Do not forward packets to or from IN_LINKLOCAL. */
+	if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) ||
+	    IN_LINKLOCAL(ntohl(ip->ip_src.s_addr))) {
+		IPSTAT_INC(ips_cantforward);
+		m_freem(m);
+		return;
+	}
 
 	/*
 	 * Not for us; forward if possible and desirable.