6 files changed, 45 insertions, 6 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 0d71fa962d8a..c97932c88ea3 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -26,7 +26,18 @@ ip_no_pmtu_disc - INTEGER
         discarded. Outgoing frames are handled the same as in mode 1,
         implicitly setting IP_PMTUDISC_DONT on every created socket.
 
-        Possible values: 0-2
+        Mode 3 is a hardend pmtu discover mode. The kernel will only
+        accept fragmentation-needed errors if the underlying protocol
+        can verify them besides a plain socket lookup. Current
+        protocols for which pmtu events will be honored are TCP, SCTP
+        and DCCP as they verify e.g. the sequence number or the
+        association. This mode should not be enabled globally but is
+        only intended to secure e.g. name servers in namespaces where
+        TCP path mtu must still work but path MTU information of other
+        protocols should be discarded. If enabled globally this mode
+        could break other protocols.
+
+        Possible values: 0-3
         Default: FALSE
 
 min_pmtu - INTEGER
diff --git a/include/net/protocol.h b/include/net/protocol.h
index fbf7676c9a02..0e5f8665d7fb 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -43,7 +43,12 @@ struct net_protocol {
         int                     (*handler)(struct sk_buff *skb);
         void                    (*err_handler)(struct sk_buff *skb, u32 info);
         unsigned int            no_policy:1,
-                                netns_ok:1;
+                                netns_ok:1,
+                                /* does the protocol do more stringent
+                                 * icmp tag validation than simple
+                                 * socket lookup?
+                                 */
+                                icmp_strict_tag_validation:1;
 };
 
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 88299c29101d..22b5d818b200 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -989,6 +989,7 @@ static const struct net_protocol dccp_v4_protocol = {
         .err_handler    = dccp_v4_err,
         .no_policy      = 1,
         .netns_ok       = 1,
+        .icmp_strict_tag_validation = 1,
 };
 
 static const struct proto_ops inet_dccp_ops = {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 6268a4751e64..ecd2c3f245ce 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1545,6 +1545,7 @@ static const struct net_protocol tcp_protocol = {
         .err_handler    =       tcp_v4_err,
         .no_policy      =       1,
         .netns_ok       =       1,
+        .icmp_strict_tag_validation = 1,
 };
 
 static const struct net_protocol udp_protocol = {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index fb3c5637199d..0134663fdbce 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -668,6 +668,16 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
         rcu_read_unlock();
 }
 
+static bool icmp_tag_validation(int proto)
+{
+        bool ok;
+
+        rcu_read_lock();
+        ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+        rcu_read_unlock();
+        return ok;
+}
+
 /*
  *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
  *      ICMP_PARAMETERPROB.
@@ -705,12 +715,22 @@ static void icmp_unreach(struct sk_buff *skb)
                 case ICMP_PORT_UNREACH:
                         break;
                 case ICMP_FRAG_NEEDED:
-                        if (net->ipv4.sysctl_ip_no_pmtu_disc == 2) {
-                                goto out;
-                        } else if (net->ipv4.sysctl_ip_no_pmtu_disc) {
+                        /* for documentation of the ip_no_pmtu_disc
+                         * values please see
+                         * Documentation/networking/ip-sysctl.txt
+                         */
+                        switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
+                        default:
                                 LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
                                                &iph->daddr);
-                        } else {
+                                break;
+                        case 2:
+                                goto out;
+                        case 3:
+                                if (!icmp_tag_validation(iph->protocol))
+                                        goto out;
+                                /* fall through */
+                        case 0:
                                 info = ntohs(icmph->un.frag.mtu);
                                 if (!info)
                                         goto out;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 34b7726bcd7f..7c161084f241 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1030,6 +1030,7 @@ static const struct net_protocol sctp_protocol = {
         .err_handler = sctp_v4_err,
         .no_policy   = 1,
         .netns_ok    = 1,
+        .icmp_strict_tag_validation = 1,
 };
 
 /* IPv4 address related functions.  */