|
936 | 936 | }
|
937 | 937 |
|
938 | 938 | xUDPPacket_IPv6->xUDPHeader.usLength = FreeRTOS_htons( ( uint16_t ) lNetLength + ipSIZE_OF_UDP_HEADER );
|
| 939 | + |
| 940 | + if( xUDPPacket_IPv6->xUDPHeader.usDestinationPort == FreeRTOS_ntohs( ipMDNS_PORT ) ) |
| 941 | + { |
| 942 | + /* RFC6762, section 11 */ |
| 943 | + xUDPPacket_IPv6->xIPHeader.ucHopLimit = 255U; |
| 944 | + } |
| 945 | + else if( xUDPPacket_IPv6->xUDPHeader.usDestinationPort == FreeRTOS_ntohs( ipLLMNR_PORT ) ) |
| 946 | + { |
| 947 | + /* LLMNR: RFC4795 section 2.5 recommends UDP requests and responses use TTL of 255 */ |
| 948 | + |
| 949 | + /* Theoretically, LLMNR replies can go "off-link" and create a DDoS scenario. That should be preventable |
| 950 | + * by settings our rely's TTL/HopLimit to 1. Please note that in certain situations ( I think unicast |
| 951 | + * responses), Wireshark flags some LLMNR packets that have TTL of 1 as too low. */ |
| 952 | + xUDPPacket_IPv6->xIPHeader.ucHopLimit = 1U; |
| 953 | + } |
| 954 | + else |
| 955 | + { |
| 956 | + xUDPPacket_IPv6->xIPHeader.ucHopLimit = ipconfigUDP_TIME_TO_LIVE; |
| 957 | + } |
| 958 | + |
939 | 959 | vFlip_16( pxUDPHeader->usSourcePort, pxUDPHeader->usDestinationPort );
|
940 | 960 | uxDataLength = ( size_t ) lNetLength + ipSIZE_OF_IPv6_HEADER + ipSIZE_OF_UDP_HEADER + ipSIZE_OF_ETH_HEADER;
|
941 | 961 | }
|
|
951 | 971 | /* HT:endian: should not be translated, copying from packet to packet */
|
952 | 972 | if( pxIPHeader->ulDestinationIPAddress == ipMDNS_IP_ADDRESS )
|
953 | 973 | {
|
| 974 | + /* RFC6762, section 11 */ |
954 | 975 | pxIPHeader->ucTimeToLive = ipMDNS_TIME_TO_LIVE;
|
955 | 976 | }
|
| 977 | + else if( pxUDPHeader->usDestinationPort == FreeRTOS_ntohs( ipLLMNR_PORT ) ) |
| 978 | + { |
| 979 | + /* LLMNR: RFC4795 section 2.5 recommends UDP requests and responses use TTL of 255 */ |
| 980 | + |
| 981 | + /* Theoretically, LLMNR replies can go "off-link" and create a DDoS scenario. That should be preventable |
| 982 | + * by settings our rely's TTL/HopLimit to 1. Please note that in certain situations ( I think unicast |
| 983 | + * responses), Wireshark flags some LLMNR packets that have TTL of 1 as too low. */ |
| 984 | + pxIPHeader->ucTimeToLive = 1; |
| 985 | + } |
956 | 986 | else
|
957 | 987 | {
|
958 | 988 | pxIPHeader->ulDestinationIPAddress = pxIPHeader->ulSourceIPAddress;
|
|
0 commit comments