| Message ID | 20100318142732.4de0f8d7@nehalam |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Stephen Hemminger <shemminger@vyatta.com> Date: Thu, 18 Mar 2010 14:27:32 -0700 > This adds RFC5082 checks for TTL on received ICMP packets. > It adds some security against spoofed ICMP packets > disrupting GTSM protected sessions. > > Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Applied. > Please apply to 2.6.33 since it basically a "follow correct RFC" > fix to original GTSM patch. Queued up for -stable, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
----- "David Miller" <davem@davemloft.net> wrote: > From: Stephen Hemminger <shemminger@vyatta.com> > Date: Thu, 18 Mar 2010 14:27:32 -0700 > > > This adds RFC5082 checks for TTL on received ICMP packets. > > It adds some security against spoofed ICMP packets > > disrupting GTSM protected sessions. > > > > Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> > > Applied. > > > Please apply to 2.6.33 since it basically a "follow correct RFC" > > fix to original GTSM patch. > I meant 2.6.34... min_ttl is not in 2.6.33 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Stephen Hemminger <stephen.hemminger@vyatta.com> Date: Sat, 20 Mar 2010 17:05:14 -0700 (PDT) >> From: Stephen Hemminger <shemminger@vyatta.com> >> Date: Thu, 18 Mar 2010 14:27:32 -0700 >> >> > Please apply to 2.6.33 since it basically a "follow correct RFC" >> > fix to original GTSM patch. >> > > I meant 2.6.34... min_ttl is not in 2.6.33 Gotcha. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
--- a/net/ipv4/tcp_ipv4.c 2010-03-18 11:10:14.396384060 -0700 +++ b/net/ipv4/tcp_ipv4.c 2010-03-18 11:13:09.115759682 -0700 @@ -370,6 +370,11 @@ void tcp_v4_err(struct sk_buff *icmp_skb if (sk->sk_state == TCP_CLOSE) goto out; + if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { + NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); + goto out; + } + icsk = inet_csk(sk); tp = tcp_sk(sk); seq = ntohl(th->seq);
This adds RFC5082 checks for TTL on received ICMP packets. It adds some security against spoofed ICMP packets disrupting GTSM protected sessions. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> --- Please apply to 2.6.33 since it basically a "follow correct RFC" fix to original GTSM patch. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html