diff options
| author | gVisor bot <gvisor-bot@google.com> | 2020-11-19 19:51:34 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-11-19 19:51:34 +0000 |
| commit | 7dcd014bcfe17836a8ef57e0f840d3c574d07965 (patch) | |
| tree | b53fcd58efc5bfeb9a07e5607d579a0695f416ef /pkg/tcpip/network/ipv6/icmp.go | |
| parent | aeedb109c57a31a68b640ede70235d1e1a569c17 (diff) | |
| parent | 27ee4fe76ad586ac8751951a842b3681f9375025 (diff) | |
Merge release-20201109.0-88-g27ee4fe76 (automated)
Diffstat (limited to 'pkg/tcpip/network/ipv6/icmp.go')
| -rw-r--r-- | pkg/tcpip/network/ipv6/icmp.go | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/pkg/tcpip/network/ipv6/icmp.go b/pkg/tcpip/network/ipv6/icmp.go index beb8f562e..386d98a29 100644 --- a/pkg/tcpip/network/ipv6/icmp.go +++ b/pkg/tcpip/network/ipv6/icmp.go @@ -796,7 +796,8 @@ func (p *protocol) returnError(reason icmpReason, pkt *stack.PacketBuffer) *tcpi allowResponseToMulticast = reason.respondToMulticast } - if (!allowResponseToMulticast && header.IsV6MulticastAddress(origIPHdrDst)) || origIPHdrSrc == header.IPv6Any { + isOrigDstMulticast := header.IsV6MulticastAddress(origIPHdrDst) + if (!allowResponseToMulticast && isOrigDstMulticast) || origIPHdrSrc == header.IPv6Any { return nil } @@ -812,8 +813,13 @@ func (p *protocol) returnError(reason icmpReason, pkt *stack.PacketBuffer) *tcpi // If we are operating as a router, do not use the packet's destination // address as the response's source address as we should not own the // destination address of a packet we are forwarding. + // + // If the packet was originally destined to a multicast address, then do not + // use the packet's destination address as the source for the response ICMP + // packet as "multicast addresses must not be used as source addresses in IPv6 + // packets", as per RFC 4291 section 2.7. localAddr := origIPHdrDst - if _, ok := reason.(*icmpReasonHopLimitExceeded); ok { + if _, ok := reason.(*icmpReasonHopLimitExceeded); ok || isOrigDstMulticast { localAddr = "" } // Even if we were able to receive a packet from some remote, we may not have |