Changeset 49607 in vbox

Timestamp:

Nov 21, 2013 3:24:27 PM (11 years ago)

Author:

vboxsync

Message:

Use ICMP filters if present.

File:

• trunk/src/VBox/NetworkServices/NAT/pxping.c (modified) (2 diffs)

trunk/src/VBox/NetworkServices/NAT/pxping.c

@@ -232 +232 @@
     g_pxping.sock4 = sock4;
     if (g_pxping.sock4 != INVALID_SOCKET) {
+#ifdef ICMP_FILTER
+        struct icmp_filter flt = { ~(uint32_t)(1U << ICMP_ECHOREPLY) };
+
+        status = setsockopt(icmpsock4, IPPROTO_ICMP, ICMP_FILTER,
+                            &flt, sizeof(flt));
+        if (status < 0) {
+            perror("ICMP_FILTER");
+        }
+#endif  /* ICMP_FILTER */
+
         g_pxping.ttl = -1;
         g_pxping.tos = 0;
@@ -245 +255 @@
     g_pxping.sock6 = sock6;
     if (g_pxping.sock6 != INVALID_SOCKET) {
+#ifdef ICMP6_FILTER
+        struct icmp6_filter flt;
+        ICMP6_FILTER_SETBLOCKALL(&flt);
+
+        ICMP6_FILTER_SETPASS(ICMP6_ECHO_REPLY, &flt);
+
+        ICMP6_FILTER_SETPASS(ICMP6_DST_UNREACH, &flt);
+        ICMP6_FILTER_SETPASS(ICMP6_PACKET_TOO_BIG, &flt);
+        ICMP6_FILTER_SETPASS(ICMP6_TIME_EXCEEDED, &flt);
+        ICMP6_FILTER_SETPASS(ICMP6_PARAM_PROB, &flt);
+
+        status = setsockopt(icmpsock6, IPPROTO_ICMPV6, ICMP6_FILTER,
+                            &flt, sizeof(flt));
+        if (status < 0) {
+            perror("ICMP6_FILTER");
+        }
+#endif  /* ICMP6_FILTER */
+
         g_pxping.hopl = -1;