summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_input.c
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2002-02-21 08:39:33 +0000
committeritojun <itojun@NetBSD.org>2002-02-21 08:39:33 +0000
commit9c68db2bfc92c3a74ef12f08aed4daf5d34bf0df (patch)
tree81fc1b8d64ac903a5bafca59de6f5325a63a35a5 /sys/netinet/ip_input.c
parent60dccae12112aaa7ea4d00f13875ad106b984858 (diff)
suppress source quence message, based on router-req RFC (also could be abused
as DoS traffic generator). from kjc/kame
Diffstat (limited to 'sys/netinet/ip_input.c')
-rw-r--r--sys/netinet/ip_input.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 7b9c2be33b5..6da94cf52ae 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_input.c,v 1.142 2001/11/28 09:25:13 darrenr Exp $ */
+/* $NetBSD: ip_input.c,v 1.143 2002/02/21 08:39:33 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -102,7 +102,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.142 2001/11/28 09:25:13 darrenr Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.143 2002/02/21 08:39:33 itojun Exp $");
#include "opt_gateway.h"
#include "opt_pfil_hooks.h"
@@ -1665,9 +1665,21 @@ ip_forward(m, srcrt)
break;
case ENOBUFS:
+#if 1
+ /*
+ * a router should not generate ICMP_SOURCEQUENCH as
+ * required in RFC1812 Requirements for IP Version 4 Routers.
+ * source quench could be a big problem under DoS attacks,
+ * or the underlying interface is rate-limited.
+ */
+ if (mcopy)
+ m_freem(mcopy);
+ return;
+#else
type = ICMP_SOURCEQUENCH;
code = 0;
break;
+#endif
}
icmp_error(mcopy, type, code, dest, destifp);
}