On Mon, 11 Jan 2010 12:25:23 +0100 Eric Dumazet <[email protected]> wrote:
> Le 11/01/2010 07:00, Stephen Hemminger a écrit : > > This patch adds the kernel portions needed to implement > > RFC 5082 Generalized TTL Security Mechanism (GTSM). > > It is a lightweight security measure against forged > > packets causing DoS attacks (for BGP). > > > > This is already implemented the same way in BSD kernels. > > For the necessary Quagga patch > > http://www.gossamer-threads.com/lists/quagga/dev/17389 > > > > Description from Cisco > > > > http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html > > > > It does add one byte to each socket structure, but I did > > a little rearrangement to reuse a hole (on 64 bit), but it > > does grow the structure on 32 bit > > > > This should be documented on ip(4) man page and the Glibc in.h > > file also needs update. IPV6_MINHOPLIMIT should also be added > > (although BSD doesn't support that). > > > > Only TCP is supported, but could also be added to UDP, DCCP, SCTP > > if desired. > > > > Signed-off-by: Stephen Hemminger <[email protected]> > > > > > --- a/net/ipv4/tcp_ipv4.c 2010-01-10 21:06:42.931093698 -0800 > > +++ b/net/ipv4/tcp_ipv4.c 2010-01-10 21:08:21.537513427 -0800 > > @@ -1649,6 +1649,9 @@ int tcp_v4_rcv(struct sk_buff *skb) > > if (!sk) > > goto no_tcp_socket; > > > > + if (iph->ttl < inet_sk(sk)->min_ttl) > > + goto discard_and_relse; > > + > > process: > > if (sk->sk_state == TCP_TIME_WAIT) > > goto do_time_wait; > > Just wondering if perfoming the check at connection establishment time > (SYN or SYN-ACK packet) instead of every received packet would be enough ? We could but: 1. GTSM is trying to protect against Man in the Middle attacks to existing BGP connections 2. That is not what BSD (or other vendors) do. > Of course, for listeners waiting for connexions from different peers (and > different > ttl values), it would be tricky. > > Check should be done at user level, if we store ttl value of SYN packet and > let > user application read its value by a getsockopt() I think IP_RECVTTL would work for that idea. -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
