1 files changed, 24 insertions, 0 deletions

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 510aa747a404..53b546019fd5 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1092,6 +1092,12 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 return;
         }
 
+        if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 RA: from host or unauthorized router\n");
+                return;
+        }
+
         /*
          *      set the RA_RECV flag in the interface
          */
@@ -1115,6 +1121,10 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 return;
         }
 
+        /* skip link-specific parameters from interior routers */
+        if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
+                goto skip_linkparms;
+
         if (in6_dev->if_flags & IF_RS_SENT) {
                 /*
                  *      flag that an RA was received after an RS was sent
@@ -1229,6 +1239,8 @@ skip_defrtr:
                 }
         }
 
+skip_linkparms:
+
         /*
          *      Process options.
          */
@@ -1268,6 +1280,10 @@ skip_defrtr:
         }
 #endif
 
+        /* skip link-specific ndopts from interior routers */
+        if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
+                goto out;
+
         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
                 struct nd_opt_hdr *p;
                 for (p = ndopts.nd_opts_pi;
@@ -1331,6 +1347,14 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         int optlen;
         u8 *lladdr = NULL;
 
+        switch (skb->ndisc_nodetype) {
+        case NDISC_NODETYPE_HOST:
+        case NDISC_NODETYPE_NODEFAULT:
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: from host or unauthorized router\n");
+                return;
+        }
+
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: source address is not link-local.\n");