|
936 | 936 | } |
937 | 937 |
|
938 | 938 | xUDPPacket_IPv6->xUDPHeader.usLength = FreeRTOS_htons( ( uint16_t ) lNetLength + ipSIZE_OF_UDP_HEADER ); |
| 939 | + |
| 940 | + if( xUDPPacket_IPv6->xUDPHeader.usDestinationPort == FreeRTOS_ntohs( ipMDNS_PORT ) ) |
| 941 | + { |
| 942 | + /* RFC6762, section 11 */ |
| 943 | + xUDPPacket_IPv6->xIPHeader.ucHopLimit = 255U; |
| 944 | + } |
| 945 | + else if( xUDPPacket_IPv6->xUDPHeader.usDestinationPort == FreeRTOS_ntohs( ipLLMNR_PORT ) ) |
| 946 | + { |
| 947 | + /* LLMNR: RFC4795 section 2.5 recommends UDP requests and responses use TTL of 255 */ |
| 948 | + |
| 949 | + /* Theoretically, LLMNR replies can go "off-link" and create a DDoS scenario. That should be preventable |
| 950 | + * by settings our rely's TTL/HopLimit to 1. Please note that in certain situations ( I think unicast |
| 951 | + * responses), Wireshark flags some LLMNR packets that have TTL of 1 as too low. */ |
| 952 | + xUDPPacket_IPv6->xIPHeader.ucHopLimit = 1U; |
| 953 | + } |
| 954 | + else |
| 955 | + { |
| 956 | + xUDPPacket_IPv6->xIPHeader.ucHopLimit = ipconfigUDP_TIME_TO_LIVE; |
| 957 | + } |
| 958 | + |
939 | 959 | vFlip_16( pxUDPHeader->usSourcePort, pxUDPHeader->usDestinationPort ); |
940 | 960 | uxDataLength = ( size_t ) lNetLength + ipSIZE_OF_IPv6_HEADER + ipSIZE_OF_UDP_HEADER + ipSIZE_OF_ETH_HEADER; |
941 | 961 | } |
|
951 | 971 | /* HT:endian: should not be translated, copying from packet to packet */ |
952 | 972 | if( pxIPHeader->ulDestinationIPAddress == ipMDNS_IP_ADDRESS ) |
953 | 973 | { |
| 974 | + /* RFC6762, section 11 */ |
954 | 975 | pxIPHeader->ucTimeToLive = ipMDNS_TIME_TO_LIVE; |
955 | 976 | } |
| 977 | + else if( pxUDPHeader->usDestinationPort == FreeRTOS_ntohs( ipLLMNR_PORT ) ) |
| 978 | + { |
| 979 | + /* LLMNR: RFC4795 section 2.5 recommends UDP requests and responses use TTL of 255 */ |
| 980 | + |
| 981 | + /* Theoretically, LLMNR replies can go "off-link" and create a DDoS scenario. That should be preventable |
| 982 | + * by settings our rely's TTL/HopLimit to 1. Please note that in certain situations ( I think unicast |
| 983 | + * responses), Wireshark flags some LLMNR packets that have TTL of 1 as too low. */ |
| 984 | + pxIPHeader->ucTimeToLive = 1; |
| 985 | + } |
956 | 986 | else |
957 | 987 | { |
958 | 988 | pxIPHeader->ulDestinationIPAddress = pxIPHeader->ulSourceIPAddress; |
|
0 commit comments