diff mbox

tcp: Generalized TTL Security Mechanism

Message ID 1268986871.3048.9.camel@edumazet-laptop
State Not Applicable, archived
Delegated to: David Miller
Headers show

Commit Message

Eric Dumazet March 19, 2010, 8:21 a.m. UTC 
Le vendredi 19 mars 2010 à 09:58 +0200, Pekka Savola a écrit :
> 
> > But any application using GTSM should be setting IP_TTL socket
> option
> > to set send TTL. But, not sure if Linux TCP ever sends ICMP
> > for existing sessions at all.
> 
> Thanks, Stephen!  It's nice to see at least one compliant RFC5082 
> implementation ;-)
> 
> Good point that no one should should probably even be sending ICMP 
> messages for TCP sockets, but on receive side the checks are
> important 
> :-)

This requires that any router in the path between the client and server
also respects the MINTTL when sending ICMP. Not sure how practical it
is...



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Pekka Savola March 19, 2010, 8:28 a.m. UTC | #1 
On Fri, 19 Mar 2010, Eric Dumazet wrote:
> This requires that any router in the path between the client and server
> also respects the MINTTL when sending ICMP. Not sure how practical it
> is...

You're correct that with multihop GTSM, ICMP becomes trickier.  I'm 
not sure how applicable GTSM is really in multihop scenarios, though. 
I would not recommend using it to secure e.g. with minttl=250 or 
something that uncontrollable. Your comment relates mainly to ICMP 
soft/hard errors which are not critical for correct operation. 
http://tools.ietf.org/html/draft-ietf-tcpm-icmp-attacks-11 discusses 
this.
diff mbox

Patch

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 70df409..a9d3ba5 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -367,6 +367,9 @@  void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 	if (sock_owned_by_user(sk))
 		NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 
+	if (iph->ttl < inet_sk(sk)->min_ttl)
+		goto out;
+
 	if (sk->sk_state == TCP_CLOSE)
 		goto out;