From patchwork Mon Jan 11 06:00:34 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: stephen hemminger X-Patchwork-Id: 42587 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 5A015B7C4B for ; Mon, 11 Jan 2010 17:01:04 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751300Ab0AKGAv (ORCPT ); Mon, 11 Jan 2010 01:00:51 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751221Ab0AKGAv (ORCPT ); Mon, 11 Jan 2010 01:00:51 -0500 Received: from mail.vyatta.com ([76.74.103.46]:49085 "EHLO mail.vyatta.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750895Ab0AKGAu (ORCPT ); Mon, 11 Jan 2010 01:00:50 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.vyatta.com (Postfix) with ESMTP id E2F2C4F4259; Sun, 10 Jan 2010 22:00:39 -0800 (PST) X-Virus-Scanned: amavisd-new at tahiti.vyatta.com Received: from mail.vyatta.com ([127.0.0.1]) by localhost (mail.vyatta.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FWPmskRUI2Oc; Sun, 10 Jan 2010 22:00:36 -0800 (PST) Received: from nehalam (pool-74-107-135-205.ptldor.fios.verizon.net [74.107.135.205]) by mail.vyatta.com (Postfix) with ESMTP id DC2AB4F425B; Sun, 10 Jan 2010 22:00:35 -0800 (PST) Date: Sun, 10 Jan 2010 22:00:34 -0800 From: Stephen Hemminger To: David Miller Cc: netdev@vger.kernel.org, linux-api@vger.kernel.org Subject: [PATCH] tcp: Generalized TTL Security Mechanism Message-ID: <20100110220034.4d46ba8a@nehalam> Organization: Vyatta X-Mailer: Claws Mail 3.7.2 (GTK+ 2.18.3; x86_64-pc-linux-gnu) Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch adds the kernel portions needed to implement RFC 5082 Generalized TTL Security Mechanism (GTSM). It is a lightweight security measure against forged packets causing DoS attacks (for BGP). This is already implemented the same way in BSD kernels. For the necessary Quagga patch http://www.gossamer-threads.com/lists/quagga/dev/17389 Description from Cisco http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html It does add one byte to each socket structure, but I did a little rearrangement to reuse a hole (on 64 bit), but it does grow the structure on 32 bit This should be documented on ip(4) man page and the Glibc in.h file also needs update. IPV6_MINHOPLIMIT should also be added (although BSD doesn't support that). Only TCP is supported, but could also be added to UDP, DCCP, SCTP if desired. Signed-off-by: Stephen Hemminger --- include/linux/in.h | 1 + include/net/inet_sock.h | 9 +++++++++ net/ipv4/ip_sockglue.c | 14 +++++++++++++- net/ipv4/tcp_ipv4.c | 2 ++ 4 files changed, 25 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/include/linux/in.h 2010-01-10 21:06:42.873122656 -0800 +++ b/include/linux/in.h 2010-01-10 21:06:47.802185618 -0800 @@ -84,6 +84,8 @@ struct in_addr { #define IP_ORIGDSTADDR 20 #define IP_RECVORIGDSTADDR IP_ORIGDSTADDR +#define IP_MINTTL 21 + /* IP_MTU_DISCOVER values */ #define IP_PMTUDISC_DONT 0 /* Never send DF frames */ #define IP_PMTUDISC_WANT 1 /* Use per route hints */ --- a/include/net/inet_sock.h 2010-01-10 21:06:42.893123288 -0800 +++ b/include/net/inet_sock.h 2010-01-10 21:17:50.262842588 -0800 @@ -122,10 +122,12 @@ struct inet_sock { __be32 inet_saddr; __s16 uc_ttl; __u16 cmsg_flags; - struct ip_options *opt; __be16 inet_sport; __u16 inet_id; + + struct ip_options *opt; __u8 tos; + __u8 min_ttl; __u8 mc_ttl; __u8 pmtudisc; __u8 recverr:1, --- a/net/ipv4/ip_sockglue.c 2010-01-10 21:06:42.913123212 -0800 +++ b/net/ipv4/ip_sockglue.c 2010-01-10 21:06:47.822184879 -0800 @@ -451,7 +451,8 @@ static int do_ip_setsockopt(struct sock (1<transparent = !!val; break; + case IP_MINTTL: + if (optlen < 1) + goto e_inval; + if (val < 0 || val > 255) + goto e_inval; + inet->min_ttl = val; + break; + default: err = -ENOPROTOOPT; break; @@ -1198,6 +1207,9 @@ static int do_ip_getsockopt(struct sock case IP_TRANSPARENT: val = inet->transparent; break; + case IP_MINTTL: + val = inet->min_ttl; + break; default: release_sock(sk); return -ENOPROTOOPT; --- a/net/ipv4/tcp_ipv4.c 2010-01-10 21:06:42.931093698 -0800 +++ b/net/ipv4/tcp_ipv4.c 2010-01-10 21:08:21.537513427 -0800 @@ -1649,6 +1649,9 @@ int tcp_v4_rcv(struct sk_buff *skb) if (!sk) goto no_tcp_socket; + if (iph->ttl < inet_sk(sk)->min_ttl) + goto discard_and_relse; + process: if (sk->sk_state == TCP_TIME_WAIT) goto do_time_wait;