From owner-freebsd-bugs@FreeBSD.ORG Tue Nov 11 15:40:02 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3AC95106567D for ; Tue, 11 Nov 2008 15:40:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 18EB38FC19 for ; Tue, 11 Nov 2008 15:40:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id mABFe1kR072791 for ; Tue, 11 Nov 2008 15:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id mABFe14g072790; Tue, 11 Nov 2008 15:40:01 GMT (envelope-from gnats) Resent-Date: Tue, 11 Nov 2008 15:40:01 GMT Resent-Message-Id: <200811111540.mABFe14g072790@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nick Hilliard Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 644DC106567D for ; Tue, 11 Nov 2008 15:38:49 +0000 (UTC) (envelope-from nick@muffin.acquirer.com) Received: from mail.acquirer.com (cl-284.dub-01.ie.sixxs.net [IPv6:2001:770:100:11b::2]) by mx1.freebsd.org (Postfix) with ESMTP id C32CA8FC26 for ; Tue, 11 Nov 2008 15:38:48 +0000 (UTC) (envelope-from nick@muffin.acquirer.com) Received: from muffin.acquirer.com (localhost [127.0.0.1]) by mail.acquirer.com (8.14.3/8.14.3) with ESMTP id mABFcY0P077620 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 11 Nov 2008 15:38:34 GMT (envelope-from nick@muffin.acquirer.com) Received: (from nick@localhost) by muffin.acquirer.com (8.14.3/8.13.8/Submit) id mABFcYAh022560; Tue, 11 Nov 2008 15:38:34 GMT (envelope-from nick) Message-Id: <200811111538.mABFcYAh022560@muffin.acquirer.com> Date: Tue, 11 Nov 2008 15:38:34 GMT From: Nick Hilliard To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/128790: [patch] bug in IP_MINTTL setsockopt() implementation X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Nick Hilliard List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Nov 2008 15:40:02 -0000 >Number: 128790 >Category: kern >Synopsis: [patch] bug in IP_MINTTL setsockopt() implementation >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Nov 11 15:40:01 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Nick Hilliard >Release: FreeBSD 6.1-RELEASE i386 >Organization: Network Ability Ltd >Environment: System: FreeBSD xx 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Wed May 17 11:38:53 IST 2006 nick@xxx:/data/src/usr.src/src-6.1/src/sys/i386/compile/xxx i386 >Description: The IP_MINTTL socket option allows implementation of GTSM - RFC 5082. This is useful for BGP session security, and is implemented in OpenBGPD 4.3. >From perusing the kernel code, you can set inp->inp_ip_minttl to any value between 1 and MAXTTL (i.e. 255). These are permissable TTL values. However, when setting up the inp structure, inp_ip_minttl will be initialised to zero. Also, there are various checks in /sys/netinet/raw_ip.c, /sys/netinet/tcp_input.c and /sys/netinet/udp_usrreq.c which only perform a MINTTL check if inp->inp_ip_minttl is set to nonzero. This suggests that zero is a valid value for inp_ip_minttl. However, there is a bug in the implementation on {free,open,dragonfly}bsd which prevents a programmer from calling the setsockopt() IP_MINTTL with a value of zero. Patch below to fix this behaviour. >How-To-Repeat: int minttl = 0; ret = setsockopt (sock, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl)); [expect ret == -1] >Fix: --- /sys/netinet/ip_output.c~ 2008-11-03 15:22:39.000000000 +0000 +++ /sys/netinet/ip_output.c 2008-11-03 15:22:39.000000000 +0000 @@ -865,7 +865,7 @@ break; case IP_MINTTL: - if (optval > 0 && optval <= MAXTTL) + if (optval >= 0 && optval <= MAXTTL) inp->inp_ip_minttl = optval; else error = EINVAL; >Release-Note: >Audit-Trail: >Unformatted: