Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7272c2f authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by David S. Miller
Browse files

net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68 



According to RFC 1191 sections 3 and 4, ICMP frag-needed messages
indicating an MTU below 68 should be rejected:

    A host MUST never reduce its estimate of the Path MTU below 68
    octets.

and (talking about ICMP frag-needed's Next-Hop MTU field):

    This field will never contain a value less than 68, since every
    router "must be able to forward a datagram of 68 octets without
    fragmentation".

Furthermore, by letting net.ipv4.route.min_pmtu be set to negative
values, we can end up with a very large PMTU when (-1) is cast into u32.

Let's also make ip_rt_min_pmtu a u32, since it's only ever compared to
unsigned ints.

Reported-by: default avatarJianlin Shi <jishi@redhat.com>
Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Reviewed-by: default avatarStefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 68b116a2

net/ipv4/route.c

+6 −2
Original line number Diff line number Diff line
@@ -128,10 +128,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1)); 
static int ip_rt_error_cost __read_mostly	= HZ;

static int ip_rt_error_burst __read_mostly	= 5 * HZ;

static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;

static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;

static u32 ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;

static int ip_rt_min_advmss __read_mostly	= 256;



static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;



static int ip_min_valid_pmtu __read_mostly	= IPV4_MIN_MTU;



/*

 *	Interface to generic destination cache.

 */
@@ -2933,7 +2936,8 @@ static struct ctl_table ipv4_route_table[] = { 
		.data		= &ip_rt_min_pmtu,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &ip_min_valid_pmtu,

	},

	{

		.procname	= "min_adv_mss",