summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorStephen Hemminger <shemminger@vyatta.com>2010-01-11 16:28:01 -0800
committerDavid S. Miller <davem@davemloft.net>2010-01-11 16:28:01 -0800
commitd218d11133d888f9745802146a50255a4781d37a (patch)
tree3b4b163238e19c48f37f3d8a77eb27f3a18691a0 /include
parentc8e000604bce02a87742240a9b716a0f1b680c0b (diff)
downloadblackbird-op-linux-d218d11133d888f9745802146a50255a4781d37a.tar.gz
blackbird-op-linux-d218d11133d888f9745802146a50255a4781d37a.zip
tcp: Generalized TTL Security Mechanism
This patch adds the kernel portions needed to implement RFC 5082 Generalized TTL Security Mechanism (GTSM). It is a lightweight security measure against forged packets causing DoS attacks (for BGP). This is already implemented the same way in BSD kernels. For the necessary Quagga patch http://www.gossamer-threads.com/lists/quagga/dev/17389 Description from Cisco http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html It does add one byte to each socket structure, but I did a little rearrangement to reuse a hole (on 64 bit), but it does grow the structure on 32 bit This should be documented on ip(4) man page and the Glibc in.h file also needs update. IPV6_MINHOPLIMIT should also be added (although BSD doesn't support that). Only TCP is supported, but could also be added to UDP, DCCP, SCTP if desired. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
-rw-r--r--include/linux/in.h2
-rw-r--r--include/net/inet_sock.h4
2 files changed, 5 insertions, 1 deletions
diff --git a/include/linux/in.h b/include/linux/in.h
index b615649db129..583c76f9c30f 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -84,6 +84,8 @@ struct in_addr {
#define IP_ORIGDSTADDR 20
#define IP_RECVORIGDSTADDR IP_ORIGDSTADDR
+#define IP_MINTTL 21
+
/* IP_MTU_DISCOVER values */
#define IP_PMTUDISC_DONT 0 /* Never send DF frames */
#define IP_PMTUDISC_WANT 1 /* Use per route hints */
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index bd4c53f75ac0..83fd34437cf1 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -122,10 +122,12 @@ struct inet_sock {
__be32 inet_saddr;
__s16 uc_ttl;
__u16 cmsg_flags;
- struct ip_options *opt;
__be16 inet_sport;
__u16 inet_id;
+
+ struct ip_options *opt;
__u8 tos;
+ __u8 min_ttl;
__u8 mc_ttl;
__u8 pmtudisc;
__u8 recverr:1,
OpenPOWER on IntegriCloud