tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipv6: add option to drop unicast encapsulated in L2 multicast

Browse Source 
In order to solve a problem with 802.11, the so-called hole-196 attack,
add an option (sysctl) called "drop_unicast_in_l2_multicast" which, if
enabled, causes the stack to drop IPv6 unicast packets encapsulated in
link-layer multi- or broadcast frames. Such frames can (as an attack)
be created by any member of the same wireless network and transmitted
as valid encrypted frames since the symmetric key for broadcast frames
is shared between all stations.

Reviewed-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Johannes Berg
2016-02-04 13:31:19 +01:00
committed by David S. Miller
parent 97daf33145
commit abbc30436d
5 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Documentation/networking/ip-sysctl.txt
View File

@@ -1674,6 +1674,12 @@ stable_secret - IPv6 address
By default the stable secret is unset.
drop_unicast_in_l2_multicast - BOOLEAN
Drop any unicast IPv6 packets that are received in link-layer
multicast (or broadcast) frames.
By default this is turned off.
icmp/*:
ratelimit - INTEGER
Limit the maximal rates for sending ICMPv6 packets.