ipv6: add option to drop unicast encapsulated in L2 multicast
authorJohannes Berg <johannes.berg@intel.com>
Thu, 4 Feb 2016 12:31:19 +0000 (13:31 +0100)
committerDavid S. Miller <davem@davemloft.net>
Thu, 11 Feb 2016 09:27:36 +0000 (04:27 -0500)
commitabbc30436d39dfed8ebfca338d253f211ac7b094
treed7ce58e0300818d2effa7a7bd03bd5667f0d9d36
parent97daf331455077645ae1f13438bebd3d1a2e94ee
ipv6: add option to drop unicast encapsulated in L2 multicast

In order to solve a problem with 802.11, the so-called hole-196 attack,
add an option (sysctl) called "drop_unicast_in_l2_multicast" which, if
enabled, causes the stack to drop IPv6 unicast packets encapsulated in
link-layer multi- or broadcast frames. Such frames can (as an attack)
be created by any member of the same wireless network and transmitted
as valid encrypted frames since the symmetric key for broadcast frames
is shared between all stations.

Reviewed-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Documentation/networking/ip-sysctl.txt
include/linux/ipv6.h
include/uapi/linux/ipv6.h
net/ipv6/addrconf.c
net/ipv6/ip6_input.c