aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4/tcp_ipv4.c
diff options
context:
space:
mode:
authorStephen Hemminger <shemminger@vyatta.com>2010-01-11 19:28:01 -0500
committerDavid S. Miller <davem@davemloft.net>2010-01-11 19:28:01 -0500
commitd218d11133d888f9745802146a50255a4781d37a (patch)
tree3b4b163238e19c48f37f3d8a77eb27f3a18691a0 /net/ipv4/tcp_ipv4.c
parentc8e000604bce02a87742240a9b716a0f1b680c0b (diff)
tcp: Generalized TTL Security Mechanism
This patch adds the kernel portions needed to implement RFC 5082 Generalized TTL Security Mechanism (GTSM). It is a lightweight security measure against forged packets causing DoS attacks (for BGP). This is already implemented the same way in BSD kernels. For the necessary Quagga patch http://www.gossamer-threads.com/lists/quagga/dev/17389 Description from Cisco http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html It does add one byte to each socket structure, but I did a little rearrangement to reuse a hole (on 64 bit), but it does grow the structure on 32 bit This should be documented on ip(4) man page and the Glibc in.h file also needs update. IPV6_MINHOPLIMIT should also be added (although BSD doesn't support that). Only TCP is supported, but could also be added to UDP, DCCP, SCTP if desired. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_ipv4.c')
-rw-r--r--net/ipv4/tcp_ipv4.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 65b8ebfd078a..382f667238ec 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1649,6 +1649,9 @@ int tcp_v4_rcv(struct sk_buff *skb)
1649 if (!sk) 1649 if (!sk)
1650 goto no_tcp_socket; 1650 goto no_tcp_socket;
1651 1651
1652 if (iph->ttl < inet_sk(sk)->min_ttl)
1653 goto discard_and_relse;
1654
1652process: 1655process:
1653 if (sk->sk_state == TCP_TIME_WAIT) 1656 if (sk->sk_state == TCP_TIME_WAIT)
1654 goto do_time_wait; 1657 goto do_time_wait;