diff options
| author | andre <andre@FreeBSD.org> | 2005-08-22 16:13:08 +0000 |
|---|---|---|
| committer | andre <andre@FreeBSD.org> | 2005-08-22 16:13:08 +0000 |
| commit | 573a9535a81268ee8fa937d020dad86235127d2c (patch) | |
| tree | e4fae08b9c2716f53ec0fdfe0bc72046c99f26b9 /sys/netinet/ip_output.c | |
| parent | ef76245e903c6da9b4359edf312f385c9d1ab002 (diff) | |
| download | FreeBSD-src-573a9535a81268ee8fa937d020dad86235127d2c.zip FreeBSD-src-573a9535a81268ee8fa937d020dad86235127d2c.tar.gz | |
Add socketoption IP_MINTTL. May be used to set the minimum acceptable
TTL a packet must have when received on a socket. All packets with a
lower TTL are silently dropped. Works on already connected/connecting
and listening sockets for RAW/UDP/TCP.
This option is only really useful when set to 255 preventing packets
from outside the directly connected networks reaching local listeners
on sockets.
Allows userland implementation of 'The Generalized TTL Security Mechanism
(GTSM)' according to RFC3682. Examples of such use include the Cisco IOS
BGP implementation command "neighbor ttl-security".
MFC after: 2 weeks
Sponsored by: TCP/IP Optimization Fundraise 2005
Diffstat (limited to 'sys/netinet/ip_output.c')
| -rw-r--r-- | sys/netinet/ip_output.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index 90c50a3..b292d80 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1189,6 +1189,7 @@ ip_ctloutput(so, sopt) case IP_TOS: case IP_TTL: + case IP_MINTTL: case IP_RECVOPTS: case IP_RECVRETOPTS: case IP_RECVDSTADDR: @@ -1209,6 +1210,14 @@ ip_ctloutput(so, sopt) case IP_TTL: inp->inp_ip_ttl = optval; break; + + case IP_MINTTL: + if (optval > 0 && optval <= MAXTTL) + inp->inp_ip_minttl = optval; + else + error = EINVAL; + break; + #define OPTSET(bit) do { \ INP_LOCK(inp); \ if (optval) \ @@ -1333,6 +1342,7 @@ ip_ctloutput(so, sopt) case IP_TOS: case IP_TTL: + case IP_MINTTL: case IP_RECVOPTS: case IP_RECVRETOPTS: case IP_RECVDSTADDR: @@ -1351,6 +1361,10 @@ ip_ctloutput(so, sopt) optval = inp->inp_ip_ttl; break; + case IP_MINTTL: + optval = inp->inp_ip_minttl; + break; + #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0) case IP_RECVOPTS: |
