Re: [PATCH] tcp: Generalized TTL Security Mechanism
From: Eric Dumazet <hidden>
Date: 2010-01-11 11:25:23
Also in:
netdev
Le 11/01/2010 07:00, Stephen Hemminger a écrit :
This patch adds the kernel portions needed to implement RFC 5082 Generalized TTL Security Mechanism (GTSM). It is a lightweight security measure against forged packets causing DoS attacks (for BGP). This is already implemented the same way in BSD kernels. For the necessary Quagga patch http://www.gossamer-threads.com/lists/quagga/dev/17389 Description from Cisco http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html It does add one byte to each socket structure, but I did a little rearrangement to reuse a hole (on 64 bit), but it does grow the structure on 32 bit This should be documented on ip(4) man page and the Glibc in.h file also needs update. IPV6_MINHOPLIMIT should also be added (although BSD doesn't support that). Only TCP is supported, but could also be added to UDP, DCCP, SCTP if desired. Signed-off-by: Stephen Hemminger <redacted>
quoted hunk ↗ jump to hunk
--- a/net/ipv4/tcp_ipv4.c 2010-01-10 21:06:42.931093698 -0800 +++ b/net/ipv4/tcp_ipv4.c 2010-01-10 21:08:21.537513427 -0800@@ -1649,6 +1649,9 @@ int tcp_v4_rcv(struct sk_buff *skb) if (!sk) goto no_tcp_socket; + if (iph->ttl < inet_sk(sk)->min_ttl) + goto discard_and_relse; + process: if (sk->sk_state == TCP_TIME_WAIT) goto do_time_wait;
Just wondering if perfoming the check at connection establishment time (SYN or SYN-ACK packet) instead of every received packet would be enough ? Of course, for listeners waiting for connexions from different peers (and different ttl values), it would be tricky. Check should be done at user level, if we store ttl value of SYN packet and let user application read its value by a getsockopt()