diff options
| author | Sabrina Dubroca <sd@queasysnail.net> | 2018-02-26 16:13:43 +0100 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@microsoft.com> | 2018-03-20 23:49:48 -0400 |
| commit | 6f57f18ed1ff91744f14d392d3b810936a8e68fc (patch) | |
| tree | 76b0eda6f3f2949ddf11f2654e863eef1b4fce9d /net | |
| parent | d2cd06ce649d483c4ec89ad2c3973204d1c66d5b (diff) | |
| download | linux-6f57f18ed1ff91744f14d392d3b810936a8e68fc.tar.gz linux-6f57f18ed1ff91744f14d392d3b810936a8e68fc.tar.bz2 linux-6f57f18ed1ff91744f14d392d3b810936a8e68fc.zip | |
net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
[ Upstream commit c7272c2f1229125f74f22dcdd59de9bbd804f1c8 ]
According to RFC 1191 sections 3 and 4, ICMP frag-needed messages
indicating an MTU below 68 should be rejected:
A host MUST never reduce its estimate of the Path MTU below 68
octets.
and (talking about ICMP frag-needed's Next-Hop MTU field):
This field will never contain a value less than 68, since every
router "must be able to forward a datagram of 68 octets without
fragmentation".
Furthermore, by letting net.ipv4.route.min_pmtu be set to negative
values, we can end up with a very large PMTU when (-1) is cast into u32.
Let's also make ip_rt_min_pmtu a u32, since it's only ever compared to
unsigned ints.
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/route.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 6a9a495aff23..7a6400345cb9 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -122,10 +122,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1)); static int ip_rt_error_cost __read_mostly = HZ; static int ip_rt_error_burst __read_mostly = 5 * HZ; static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ; -static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; +static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; static int ip_rt_min_advmss __read_mostly = 256; static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; + +static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; + /* * Interface to generic destination cache. */ @@ -2689,7 +2692,8 @@ static struct ctl_table ipv4_route_table[] = { .data = &ip_rt_min_pmtu, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = &ip_min_valid_pmtu, }, { .procname = "min_adv_mss", |