netdev - Re: Unable to flush ICMP redirect routes in kernel 3.0+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111117165209.GA11813@albatros>
Date:	Thu, 17 Nov 2011 20:52:09 +0400
From:	Vasiliy Kulikov <segoon@...nwall.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	Flavio Leitner <fbl@...hat.com>,
	David Miller <davem@...emloft.net>,
	Ivan Zahariev <famzah@...soft.com>, netdev@...r.kernel.org
Subject: Re: Unable to flush ICMP redirect routes in kernel 3.0+

On Thu, Nov 17, 2011 at 15:40 +0100, Eric Dumazet wrote:
> [PATCH] ping: dont increment ICMP_MIB_INERRORS
> 
> ping module incorrectly increments ICMP_MIB_INERRORS if feeded with a
> frame not belonging to its own sockets.
> 
> RFC 2011 states that ICMP_MIB_INERRORS should count "the number of ICMP
> messages which the entiry received but determined as having
> ICMP-specific errors (bad ICMP checksums, bad length, etc.)."
> 
> Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>

Acked-by: Vasiliy Kulikov <segoon@...nwall.com>

Thanks,

> ---
>  net/ipv4/ping.c |    2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
> index a06f73f..43d4c3b 100644
> --- a/net/ipv4/ping.c
> +++ b/net/ipv4/ping.c
> @@ -339,7 +339,6 @@ void ping_err(struct sk_buff *skb, u32 info)
>  	sk = ping_v4_lookup(net, iph->daddr, iph->saddr,
>  			    ntohs(icmph->un.echo.id), skb->dev->ifindex);
>  	if (sk == NULL) {
> -		ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
>  		pr_debug("no socket, dropping\n");
>  		return;	/* No socket for error */
>  	}
> @@ -679,7 +678,6 @@ static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
>  	pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
>  		inet_sk(sk), inet_sk(sk)->inet_num, skb);
>  	if (sock_queue_rcv_skb(sk, skb) < 0) {
> -		ICMP_INC_STATS_BH(sock_net(sk), ICMP_MIB_INERRORS);
>  		kfree_skb(skb);
>  		pr_debug("ping_queue_rcv_skb -> failed\n");
>  		return -1;
> 

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html