Date: Sun, 24 Mar 2024 16:19:32 GMT From: Gleb Smirnoff <glebius@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 32aeee8ce7e7 - main - icmp6: rate limit our echo replies Message-ID: <202403241619.42OGJWFQ079555@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=32aeee8ce7e72738fff236ccd5629d55035458f8 commit 32aeee8ce7e72738fff236ccd5629d55035458f8 Author: Gleb Smirnoff <glebius@FreeBSD.org> AuthorDate: 2024-03-24 16:13:23 +0000 Commit: Gleb Smirnoff <glebius@FreeBSD.org> CommitDate: 2024-03-24 16:13:23 +0000 icmp6: rate limit our echo replies The generation of ICMP6_ECHO_REPLY bypasses icmp6_error(), thus rate limit was not applied. Reviewed by: tuexen, zlei Differential Revision: https://reviews.freebsd.org/D44480 --- sys/netinet6/icmp6.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c index 260f5c7e2467..321622bcf7ef 100644 --- a/sys/netinet6/icmp6.c +++ b/sys/netinet6/icmp6.c @@ -546,6 +546,8 @@ icmp6_input(struct mbuf **mp, int *offp, int proto) icmp6_ifstat_inc(ifp, ifs6_in_echo); if (code != 0) goto badcode; + if (icmp6_ratelimit(&ip6->ip6_src, ICMP6_ECHO_REPLY, 0)) + break; if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) == NULL) { /* Give up remote */ break;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202403241619.42OGJWFQ079555>