From 936cd18dade566c7ca5fd50cb4658f71f87ffcc1 Mon Sep 17 00:00:00 2001 From: Andre Oppermann Date: Mon, 22 Aug 2005 16:13:08 +0000 Subject: Add socketoption IP_MINTTL. May be used to set the minimum acceptable TTL a packet must have when received on a socket. All packets with a lower TTL are silently dropped. Works on already connected/connecting and listening sockets for RAW/UDP/TCP. This option is only really useful when set to 255 preventing packets from outside the directly connected networks reaching local listeners on sockets. Allows userland implementation of 'The Generalized TTL Security Mechanism (GTSM)' according to RFC3682. Examples of such use include the Cisco IOS BGP implementation command "neighbor ttl-security". MFC after: 2 weeks Sponsored by: TCP/IP Optimization Fundraise 2005 --- sys/netinet/udp_usrreq.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'sys/netinet/udp_usrreq.c') diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index 0ffb00445ce80..6de2d7b774747 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -384,6 +384,9 @@ udp_input(m, off) return; } INP_LOCK(inp); + /* Check the minimum TTL for socket. */ + if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) + goto badheadlocked; udp_append(inp, ip, m, iphlen + sizeof(struct udphdr), &udp_in); INP_UNLOCK(inp); INP_INFO_RUNLOCK(&udbinfo); -- cgit v1.3