From a588f6febeca13edd038d78e42efb8aa9f16a444 Mon Sep 17 00:00:00 2001 From: "Vittorio Gambaletta (VittGam)" Date: Thu, 3 Sep 2015 16:02:50 +0200 Subject: [PATCH] Fix DecrementTTL option. The option was not actually working, as it could be seen on traceroute or mtr. The problem is that it was checking if the TTL was < 1 (so equal to 0) before decrementing it. This meant that a packet with a TTL of 1 was being sent with a TTL of 0 on the VPN, instead of being discarded with the ICMP error message. Signed-off-by: Vittorio Gambaletta --- src/route.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/route.c b/src/route.c index c11267b1..a1254d80 100644 --- a/src/route.c +++ b/src/route.c @@ -891,7 +891,7 @@ static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) { if(!checklength(source, packet, ethlen + ip_size)) return false; - if(packet->data[ethlen + 8] < 1) { + if(packet->data[ethlen + 8] <= 1) { if(packet->data[ethlen + 11] != IPPROTO_ICMP || packet->data[ethlen + 32] != ICMP_TIME_EXCEEDED) route_ipv4_unreachable(source, packet, ethlen, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL); return false; @@ -914,7 +914,7 @@ static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) { if(!checklength(source, packet, ethlen + ip6_size)) return false; - if(packet->data[ethlen + 7] < 1) { + if(packet->data[ethlen + 7] <= 1) { if(packet->data[ethlen + 6] != IPPROTO_ICMPV6 || packet->data[ethlen + 40] != ICMP6_TIME_EXCEEDED) route_ipv6_unreachable(source, packet, ethlen, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT); return false; -- 2.20.1