diff options
| author | Andre Oppermann <andre@FreeBSD.org> | 2004-05-06 18:46:03 +0000 |
|---|---|---|
| committer | Andre Oppermann <andre@FreeBSD.org> | 2004-05-06 18:46:03 +0000 |
| commit | 2bde81acd641009fc7fd168aa4fd9b91d98240a7 (patch) | |
| tree | 22eb8e04c9df14eb5b01b9ef5afdd606f02dc0d8 /sys/netinet | |
| parent | b0e2b625f29c18e7dd3deb638a5c3fc66246c9d9 (diff) | |
Notes
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/ip_fastfwd.c | 12 | ||||
| -rw-r--r-- | sys/netinet/ip_input.c | 13 | ||||
| -rw-r--r-- | sys/netinet/ip_var.h | 1 |
3 files changed, 24 insertions, 2 deletions
diff --git a/sys/netinet/ip_fastfwd.c b/sys/netinet/ip_fastfwd.c index 002943a301fb..a73c499e17d9 100644 --- a/sys/netinet/ip_fastfwd.c +++ b/sys/netinet/ip_fastfwd.c @@ -292,8 +292,16 @@ ip_fastforward(struct mbuf *m) /* * Only IP packets without options */ - if (ip->ip_hl != (sizeof(struct ip) >> 2)) - return 0; + if (ip->ip_hl != (sizeof(struct ip) >> 2)) { + if (ip_doopts == 1) + return 0; + else if (ip_doopts == 2) { + icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB, + 0, NULL); + return 1; + } + /* else ignore IP options and continue */ + } /* * Only unicast IP, not from loopback, no L2 or IP broadcast, diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index baf44534eaa4..586d1b16141a 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -110,6 +110,10 @@ SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute, CTLFLAG_RW, &ip_acceptsourceroute, 0, "Enable accepting source routed IP packets"); +int ip_doopts = 1; /* 0 = ignore, 1 = process, 2 = reject */ +SYSCTL_INT(_net_inet_ip, OID_AUTO, process_options, CTLFLAG_RW, + &ip_doopts, 0, "Enable IP options processing ([LS]SRR, RR, TS)"); + static int ip_keepfaith = 0; SYSCTL_INT(_net_inet_ip, IPCTL_KEEPFAITH, keepfaith, CTLFLAG_RW, &ip_keepfaith, 0, @@ -1287,6 +1291,15 @@ ip_dooptions(struct mbuf *m, int pass, struct sockaddr_in *next_hop) n_time ntime; struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET }; + /* ignore or reject packets with IP options */ + if (ip_doopts == 0) + return 0; + else if (ip_doopts == 2) { + type = ICMP_UNREACH; + code = ICMP_UNREACH_FILTER_PROHIB; + goto bad; + } + dst = ip->ip_dst; cp = (u_char *)(ip + 1); cnt = (ip->ip_hl << 2) - sizeof (struct ip); diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h index be83cdea1593..ff616fbb9e61 100644 --- a/sys/netinet/ip_var.h +++ b/sys/netinet/ip_var.h @@ -147,6 +147,7 @@ extern u_short ip_id; /* ip packet ctr, for ids */ #endif extern int ip_defttl; /* default IP ttl */ extern int ipforwarding; /* ip forwarding */ +extern int ip_doopts; /* process or ignore IP options */ #ifdef IPSTEALTH extern int ipstealth; /* stealth forwarding */ #endif |