(usagi-users 00694) Re: Updating address lifetime (again)

[YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@xxxxxxxxxx>]

Thanks for your comments.
I've implemented the Jim Bound's rule.
Could you try this, please?
(I do not consider about temporary addresses at this this patch.

Index: kernel/linux24/net/ipv6/addrconf.c
===================================================================
RCS file: /cvsroot/usagi/usagi/kernel/linux24/net/ipv6/addrconf.c,v
retrieving revision 1.89
diff -u -r1.89 addrconf.c
--- kernel/linux24/net/ipv6/addrconf.c	2001/08/16 03:05:11	1.89
+++ kernel/linux24/net/ipv6/addrconf.c	2001/08/20 09:35:28
@@ -1342,6 +1342,7 @@
 		int flags;
 		struct in6_addr addr;
 		int update_lft = 0, create = 0;
+		unsigned long now, stored_lft;
 
 		if (pinfo->prefix_len != 64) {
 			ADBG2((KERN_DEBUG "IPv6 addrconf: prefix with wrong length %d\n", pinfo->prefix_len));
@@ -1370,13 +1371,21 @@
 		}
 
 		spin_lock(&ifp->lock);
+		now = jiffies;
+		if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
+			stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
+		else
+			stored_lft = 0;
 #define TWO_HOURS	7200
 		if (!update_lft) {
 			if (valid_lft > TWO_HOURS ||
-			    valid_lft > ifp->valid_lft) {
+			    valid_lft > stored_lft) {
 				update_lft = 1;
-			} else if (ifp->valid_lft <= TWO_HOURS &&
-				   valid_lft <= ifp->valid_lft) {
+			} else if (stored_lft <= TWO_HOURS
+#if 0	/* this rule is logically redundant */
+				   && valid_lft <= stored_lft
+#endif
+				   ) {
 				update_lft = 0;
 			} else {
 				valid_lft = TWO_HOURS;



BTW,

In article <Pine.LNX.4.33.0108200954140.4942-100000@xxxxxxxxxx> (at Mon, 20 Aug 2001 10:46:36 +0300 (EEST)), Pekka Savola <pekkas@xxxxxxxxxx> says:

> I'm grateful for mentioning this though, as it made me look at the ndisc
> code and spot at least one RFC2462 incompliancy:  you can DoS systems by
> advertising Lifetime 0 (the address will be removed immediately).  This,
> and other DoS'es by short, unauthenticated advertisements, is what the
> two-hour rule has been set to prevent:
> 
>         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
> [...]
>         if (rt && lifetime == 0) {
>                 ip6_del_rt(rt);
>                 rt = NULL;
>         }
> 
> This check should be removed; it's left-over from RFC1971 days when the
> two-hour rule didn't exist.

I don't think that Default Router List is affected by the Two Hours
Rule.

:
RFC 2461 says in section 6.3.{4,5}:

6.3.4.  Processing Received Router Advertisements
:
   On receipt of a valid Router Advertisement, a host extracts the
   source address of the packet and does the following:
:
      - If the address is already present in the host's Default Router
        List as a result of a previously-received advertisement, reset
        its invalidation timer to the Router Lifetime value in the
        newly-received advertisement.

      - If the address is already present in the host's Default Router
        List and the received Router Lifetime value is zero, immediately
        time-out the entry as specified in Section 6.3.5.
:
6.3.5.  Timing out Prefixes and Default Routers
:
   Whenever the Lifetime of an entry in the Default Router List expires,
   that entry is discarded.  When removing a router from the Default
   Router list, the node MUST update the Destination Cache in such a way
   that all entries using the router perform next-hop determination
   again rather than continue sending traffic to the (deleted) router.

--yoshfuji