Date: Thu, 18 Aug 2011 11:32:58 +0400 From: "Alexander V. Chernikov" <melifaro@ipfw.ru> To: "net@freebsd.org" <net@freebsd.org> Subject: IP_MINTTL and RFC5082 (TTL security, GTSM) support Message-ID: <4E4CC02A.7090104@ipfw.ru>
next in thread | raw e-mail | index | archive | help
Hello list!
FreeBSD supports IP_MINTTL since long ago (5.x ?). This is
RFC3682-compatible implementation.
It is very simple: if we can associate incoming packet with any socket,
socket is checked for minimum TTL value existence. If such value exists
and received packet TTL is lower, packet is dropped.
However, it is not enough for real security. ICMP messages are not
checked for minimum TTL (which is now required by RFC 5082 6.1.)
Icmp messages are passed via .pr_ctlinput upper level protocol hook.
Icmp code, originator address (sockaddr *) and part of problem datagramm
(received in icmp packet) are passed as arguments.
As a result, TTL of ICMP packet is not passed to upper layer proto and
TTL security cannot be enforced.
What can possibly be done:
* New hook .pr_ctlinput2 with additional argument pointing to original
ICMP header can be added. After that we convert all base code to use
.pr_ctlinput2 and appropriate icmp_input() parts can be changed like this:
ctlfunc2 = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput2;
if (ctlfunc2)
(*ctlfunc2)(code, (struct sockaddr *)&icmpsrc,
(void *)&icp->icmp_ip, (void *)icp);
else {
ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
if (ctlfunc)
(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
(void *)&icp->icmp_ip);
}
* .pr_ctlinput() can be altered (if it's not too late for 9.x) and some
trick like supplying TTL data directly after (struct sockaddr*) can be
used as 8.x MFC
P.S. We should implement IP_MINTTL variant for IPv6. I can submit
patches but this seems to be reasonable only after we got some solution
for ICMP security.
Linux people added compatible opt for IPv4 in 2.6.34:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d218d11133d888f9745802146a50255a4781d37a
.. and IPV6_MINHOPCOUNT for IPv6 in 2.6.35:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e802af9cabb011f09b9c19a82faef3dd315f27eb
so we can consider using IPV6_MINHOPCOUNT as appropriate setsockopt name
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4E4CC02A.7090104>