Discussion:
IP_RECVTTL
(too old to reply)
matthew sporleder
2009-07-08 23:13:30 UTC
Permalink
While trying to compile liboping on netbsd I ran into a lack of
IP_RECVTTL and noticed that freebsd did have this and a few other
things defined in in.h:

469 #define IP_RECVTTL 65 /* bool; receive IP TTL w/dgram */
470 #define IP_MINTTL 66 /* minimum TTL for packet or drop */
471 #define IP_DONTFRAG 67 /* don't fragment packet */

Is there a reason NetBSD doesn't have these values? Can I just patch
liboping with a local definition or is it more work to get it
supported as a socketopt?

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Min Sik Kim
2009-07-09 06:02:03 UTC
Permalink
At Wed, 8 Jul 2009 19:13:30 -0400,
Post by matthew sporleder
While trying to compile liboping on netbsd I ran into a lack of
IP_RECVTTL and noticed that freebsd did have this and a few other
I have the following diff in my local tree. If it looks okay, I'll
commit it.

diff --git a/share/man/man4/ip.4 b/share/man/man4/ip.4
index bb7e9f7..d4f2f92 100644
--- a/share/man/man4/ip.4
+++ b/share/man/man4/ip.4
@@ -165,6 +165,26 @@ cmsg_len = sizeof(struct sockaddr_dl)
cmsg_level = IPPROTO_IP
cmsg_type = IP_RECVIF
.Ed
+.Pp
+If the
+.Dv IP_RECVTTL
+option is enabled on a
+.Dv SOCK_DGRAM
+socket, the
+.Xr recvmsg 2
+call will return the
+.Tn TTL
+of the received datagram.
+The msg_control field in the msghdr structure points to a buffer
+that contains a cmsghdr structure followed by the
+.Tn TTL
+value.
+The cmsghdr fields have the following values:
+.Bd -literal
+cmsg_len = sizeof(uint8_t)
+cmsg_level = IPPROTO_IP
+cmsg_type = IP_RECVTTL
+.Ed
.Ss MULTICAST OPTIONS
.Tn IP
multicasting is supported only on
diff --git a/sys/netinet/in.h b/sys/netinet/in.h
index dda7d62..3b20016 100644
--- a/sys/netinet/in.h
+++ b/sys/netinet/in.h
@@ -282,6 +282,7 @@ struct ip_opts {
#if 1 /*IPSEC*/
#define IP_IPSEC_POLICY 22 /* struct; get/set security policy */
#endif
+#define IP_RECVTTL 23 /* bool; receive IP TTL w/dgram */

/*
* Defaults and limits for options
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index 8e1d929..3c21403 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -108,8 +108,6 @@ struct inpcb {
/* XXX should move to an UDP control block */
#define INP_ESPINUDP 0x100 /* ESP over UDP for NAT-T */
#define INP_ESPINUDP_NON_IKE 0x200 /* ESP over UDP for NAT-T */
-#define INP_CONTROLOPTS (INP_RECVOPTS|INP_RECVRETOPTS|INP_RECVDSTADDR|\
- INP_RECVIF)
#define INP_ESPINUDP_ALL (INP_ESPINUDP|INP_ESPINUDP_NON_IKE)
#define INP_NOHEADER 0x400 /* Kernel removes IP header
* before feeding a packet
@@ -118,6 +116,9 @@ struct inpcb {
* not supply an IP header.
* Cancels INP_HDRINCL.
*/
+#define INP_RECVTTL 0x800 /* receive incoming IP TTL */
+#define INP_CONTROLOPTS (INP_RECVOPTS|INP_RECVRETOPTS|INP_RECVDSTADDR|\
+ INP_RECVIF|INP_RECVTTL)

#define sotoinpcb(so) ((struct inpcb *)(so)->so_pcb)

diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 5a33fcc..7e0b77e 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -2118,6 +2118,12 @@ ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip,
if (*mp)
mp = &(*mp)->m_next;
}
+ if (inp->inp_flags & INP_RECVTTL) {
+ *mp = sbcreatecontrol((void *) &ip->ip_ttl,
+ sizeof(uint8_t), IP_RECVTTL, IPPROTO_IP);
+ if (*mp)
+ mp = &(*mp)->m_next;
+ }
}

/*
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 34b5a8b..ec1d59c 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1227,6 +1227,7 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
case IP_RECVRETOPTS:
case IP_RECVDSTADDR:
case IP_RECVIF:
+ case IP_RECVTTL:
error = sockopt_getint(sopt, &optval);
if (error)
break;
@@ -1260,6 +1261,10 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
case IP_RECVIF:
OPTSET(INP_RECVIF);
break;
+
+ case IP_RECVTTL:
+ OPTSET(INP_RECVTTL);
+ break;
}
break;
#undef OPTSET
@@ -1334,6 +1339,7 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
case IP_RECVRETOPTS:
case IP_RECVDSTADDR:
case IP_RECVIF:
+ case IP_RECVTTL:
case IP_ERRORMTU:
switch (sopt->sopt_name) {
case IP_TOS:
@@ -1365,6 +1371,10 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
case IP_RECVIF:
optval = OPTBIT(INP_RECVIF);
break;
+
+ case IP_RECVTTL:
+ optval = OPTBIT(INP_RECVTTL);
+ break;
}
error = sockopt_setint(sopt, optval);
break;
--
Min Sik Kim

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Min Sik Kim
2009-07-17 11:34:33 UTC
Permalink
At Wed, 8 Jul 2009 19:13:30 -0400,
Post by matthew sporleder
While trying to compile liboping on netbsd I ran into a lack of
IP_RECVTTL and noticed that freebsd did have this and a few other
469 #define IP_RECVTTL 65 /* bool; receive IP TTL w/dgram */
470 #define IP_MINTTL 66 /* minimum TTL for packet or drop */
471 #define IP_DONTFRAG 67 /* don't fragment packet */
The following is a patch to add IP_MINTTL.

diff --git a/share/man/man4/ip.4 b/share/man/man4/ip.4
index 35f9821..92b6b1a 100644
--- a/share/man/man4/ip.4
+++ b/share/man/man4/ip.4
@@ -186,6 +186,20 @@ cmsg_len = sizeof(uint8_t)
cmsg_level = IPPROTO_IP
cmsg_type = IP_RECVTTL
.Ed
+.Pp
+The
+.Dv IP_MINTTL
+option may be used on
+.Dv SOCK_STREAM
+sockets to discard packets with a TTL lower than the option value.
+This can be used to implement the
+.Em Generalized TTL Security Mechanism (GTSM)
+according to RFC 3682.
+To discard all packets with a TTL lower than 255:
+.Bd -literal -offset indent
+int minttl = 255;
+setsockopt(s, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl));
+.Ed
.Ss MULTICAST OPTIONS
.Tn IP
multicasting is supported only on
diff --git a/sys/netinet/in.h b/sys/netinet/in.h
index 37dfb21..4f963d4 100644
--- a/sys/netinet/in.h
+++ b/sys/netinet/in.h
@@ -283,6 +283,7 @@ struct ip_opts {
#define IP_IPSEC_POLICY 22 /* struct; get/set security policy */
#endif
#define IP_RECVTTL 23 /* bool; receive IP TTL w/dgram */
+#define IP_MINTTL 24 /* minimum TTL for packet or drop */

/*
* Defaults and limits for options
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index bd39dbb..9d0a8a3 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -91,6 +91,7 @@ struct inpcb {
struct mbuf *inp_options; /* IP options */
struct ip_moptions *inp_moptions; /* IP multicast options */
int inp_errormtu; /* MTU of last xmit status = EMSGSIZE */
+ uint8_t inp_ip_minttl;
};

#define inp_faddr inp_ip.ip_dst
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 82b9f4b..a4147c3 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1223,6 +1223,7 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)

case IP_TOS:
case IP_TTL:
+ case IP_MINTTL:
case IP_RECVOPTS:
case IP_RECVRETOPTS:
case IP_RECVDSTADDR:
@@ -1240,6 +1241,13 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
case IP_TTL:
inp->inp_ip.ip_ttl = optval;
break;
+
+ case IP_MINTTL:
+ if (optval > 0 && optval <= MAXTTL)
+ inp->inp_ip_minttl = optval;
+ else
+ error = EINVAL;
+ break;
#define OPTSET(bit) \
if (optval) \
inp->inp_flags |= bit; \
@@ -1335,6 +1343,7 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)

case IP_TOS:
case IP_TTL:
+ case IP_MINTTL:
case IP_RECVOPTS:
case IP_RECVRETOPTS:
case IP_RECVDSTADDR:
@@ -1350,6 +1359,10 @@ ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
optval = inp->inp_ip.ip_ttl;
break;

+ case IP_MINTTL:
+ optval = inp->inp_ip_minttl;
+ break;
+
case IP_ERRORMTU:
optval = inp->inp_errormtu;
break;
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 6da7591..bf877fd 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1289,6 +1289,10 @@ findpcb:
#endif
}

+ /* Check the minimum TTL for socket. */
+ if (ip->ip_ttl < inp->inp_ip_minttl)
+ goto drop;
+
/*
* If the state is CLOSED (i.e., TCB does not exist) then
* all data in the incoming segment is discarded.
--
Min Sik Kim

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Christos Zoulas
2009-07-17 12:43:47 UTC
Permalink
Post by Min Sik Kim
At Wed, 8 Jul 2009 19:13:30 -0400,
Post by matthew sporleder
While trying to compile liboping on netbsd I ran into a lack of
IP_RECVTTL and noticed that freebsd did have this and a few other
469 #define IP_RECVTTL 65 /* bool; receive IP TTL w/dgram */
470 #define IP_MINTTL 66 /* minimum TTL for packet or drop */
471 #define IP_DONTFRAG 67 /* don't fragment packet */
The following is a patch to add IP_MINTTL.
commit it.

christos


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
matthew sporleder
2009-07-17 16:13:55 UTC
Permalink
Post by Min Sik Kim
Post by Min Sik Kim
At Wed, 8 Jul 2009 19:13:30 -0400,
Post by matthew sporleder
While trying to compile liboping on netbsd I ran into a lack of
IP_RECVTTL and noticed that freebsd did have this and a few other
    469 #define      IP_RECVTTL              65   /* bool; receive IP TTL w/dgram */
    470 #define      IP_MINTTL               66   /* minimum TTL for packet or drop */
    471 #define      IP_DONTFRAG             67   /* don't fragment packet */
The following is a patch to add IP_MINTTL.
commit it.
christos
How about the IP_RECVTTL flag? Also, is it safe to define these
locally for pre-patched systems in a program, or does the rest of the
support code need to exist to be safe?

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Min Sik Kim
2009-07-18 21:51:50 UTC
Permalink
At Fri, 17 Jul 2009 12:13:55 -0400,
Post by matthew sporleder
Post by Min Sik Kim
Post by Min Sik Kim
The following is a patch to add IP_MINTTL.
commit it.
christos
How about the IP_RECVTTL flag?
It was already committed.
Post by matthew sporleder
Also, is it safe to define these locally for pre-patched systems in
a program, or does the rest of the support code need to exist to be
safe?
setsockopt(2) will return an error.
--
Min Sik Kim

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Loading...