summaryrefslogtreecommitdiffstats
path: root/include/net/addrconf.h
diff options
context:
space:
mode:
authorCatalin\(ux\) M. BOIE <catab@embedromix.ro>2013-09-23 23:04:19 +0300
committerDavid S. Miller <davem@davemloft.net>2013-09-28 15:56:15 -0400
commit7df37ff33dc122f7bd0614d707939fe84322d264 (patch)
treecaacc6c977eeb20bd408094c92a12c4bd8adfbed /include/net/addrconf.h
parent60e453a940ac678565b6641d65f8c18541bb9f28 (diff)
downloadlinux-7df37ff33dc122f7bd0614d707939fe84322d264.tar.bz2
IPv6 NAT: Do not drop DNATed 6to4/6rd packets
When a router is doing DNAT for 6to4/6rd packets the latest anti-spoofing commit 218774dc ("ipv6: add anti-spoofing checks for 6to4 and 6rd") will drop them because the IPv6 address embedded does not match the IPv4 destination. This patch will allow them to pass by testing if we have an address that matches on 6to4/6rd interface. I have been hit by this problem using Fedora and IPV6TO4_IPV4ADDR. Also, log the dropped packets (with rate limit). Signed-off-by: Catalin(ux) M. BOIE <catab@embedromix.ro> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/addrconf.h')
-rw-r--r--include/net/addrconf.h4
1 files changed, 4 insertions, 0 deletions
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index fb314de2b61b..86505bfa5d2c 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -67,6 +67,10 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
#endif
+bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
+ const unsigned int prefix_len,
+ struct net_device *dev);
+
int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev);
struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net,