From nick@muffin.acquirer.com  Tue Nov 11 15:38:49 2008
Return-Path: <nick@muffin.acquirer.com>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 644DC106567D
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 11 Nov 2008 15:38:49 +0000 (UTC)
	(envelope-from nick@muffin.acquirer.com)
Received: from mail.acquirer.com (cl-284.dub-01.ie.sixxs.net [IPv6:2001:770:100:11b::2])
	by mx1.freebsd.org (Postfix) with ESMTP id C32CA8FC26
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 11 Nov 2008 15:38:48 +0000 (UTC)
	(envelope-from nick@muffin.acquirer.com)
Received: from muffin.acquirer.com (localhost [127.0.0.1])
	by mail.acquirer.com (8.14.3/8.14.3) with ESMTP id mABFcY0P077620
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Tue, 11 Nov 2008 15:38:34 GMT
	(envelope-from nick@muffin.acquirer.com)
Received: (from nick@localhost)
	by muffin.acquirer.com (8.14.3/8.13.8/Submit) id mABFcYAh022560;
	Tue, 11 Nov 2008 15:38:34 GMT
	(envelope-from nick)
Message-Id: <200811111538.mABFcYAh022560@muffin.acquirer.com>
Date: Tue, 11 Nov 2008 15:38:34 GMT
From: Nick Hilliard <nick@foobar.org>
Reply-To: Nick Hilliard <nick@foobar.org>
To: FreeBSD-gnats-submit@freebsd.org
Subject: [patch] bug in IP_MINTTL setsockopt() implementation
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         128790
>Category:       kern
>Synopsis:       [netinet] [patch] bug in IP_MINTTL setsockopt() implementation
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    rwatson
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Nov 11 15:40:01 UTC 2008
>Closed-Date:    Sun Feb 01 20:21:00 UTC 2009
>Last-Modified:  Sun Feb 01 20:21:00 UTC 2009
>Originator:     Nick Hilliard
>Release:        FreeBSD 6.1-RELEASE i386
>Organization:
Network Ability Ltd
>Environment:
System: FreeBSD xx 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Wed May 17 11:38:53 IST 2006 nick@xxx:/data/src/usr.src/src-6.1/src/sys/i386/compile/xxx i386

>Description:

The IP_MINTTL socket option allows implementation of GTSM - RFC 5082.  This
is useful for BGP session security, and is implemented in OpenBGPD 4.3.

From perusing the kernel code, you can set inp->inp_ip_minttl to any value
between 1 and MAXTTL (i.e. 255).  These are permissable TTL values. 
However, when setting up the inp structure, inp_ip_minttl will be
initialised to zero.  Also, there are various checks in
/sys/netinet/raw_ip.c, /sys/netinet/tcp_input.c and
/sys/netinet/udp_usrreq.c which only perform a MINTTL check if
inp->inp_ip_minttl is set to nonzero.  This suggests that zero is a valid
value for inp_ip_minttl.

However, there is a bug in the implementation on {free,open,dragonfly}bsd
which prevents a programmer from calling the setsockopt() IP_MINTTL with a
value of zero.

Patch below to fix this behaviour.

>How-To-Repeat:

	int minttl = 0;
	ret = setsockopt (sock, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl));

	[expect ret == -1]

>Fix:

--- /sys/netinet/ip_output.c~	2008-11-03 15:22:39.000000000 +0000
+++ /sys/netinet/ip_output.c	2008-11-03 15:22:39.000000000 +0000
@@ -865,7 +865,7 @@
 				break;
 
 			case IP_MINTTL:
-				if (optval > 0 && optval <= MAXTTL)
+				if (optval >= 0 && optval <= MAXTTL)
 					inp->inp_ip_minttl = optval;
 				else
 					error = EINVAL;


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Wed Nov 12 19:22:37 UTC 2008 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=128790 
Responsible-Changed-From-To: freebsd-net->rwatson 
Responsible-Changed-By: rwatson 
Responsible-Changed-When: Thu Nov 13 00:15:55 UTC 2008 
Responsible-Changed-Why:  
Grab ownership of this PR, I can take a look at this. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=128790 
State-Changed-From-To: open->analyzed 
State-Changed-By: rwatson 
State-Changed-When: Sat Jan 3 11:32:22 UTC 2009 
State-Changed-Why:  
Transition to analyzed state -- I agree with the diagnosis, it should be 
permissible to set inp_ip_minttl back to zero to restore default 
behavior on a socket. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=128790 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/128790: commit references a PR
Date: Sat,  3 Jan 2009 11:35:45 +0000 (UTC)

 Author: rwatson
 Date: Sat Jan  3 11:35:31 2009
 New Revision: 186717
 URL: http://svn.freebsd.org/changeset/base/186717
 
 Log:
   Allow the IP_MINTTL socket option to be set to 0 so that it can be
   disabled entirely, which is its default state before set to a
   non-zero value.
   
   PR:		128790
   Submitted by:	Nick Hilliard <nick at foobar dot org>
   MFC after:	3 weeks
 
 Modified:
   head/sys/netinet/ip_output.c
 
 Modified: head/sys/netinet/ip_output.c
 ==============================================================================
 --- head/sys/netinet/ip_output.c	Sat Jan  3 11:25:50 2009	(r186716)
 +++ head/sys/netinet/ip_output.c	Sat Jan  3 11:35:31 2009	(r186717)
 @@ -892,7 +892,7 @@ ip_ctloutput(struct socket *so, struct s
  				break;
  
  			case IP_MINTTL:
 -				if (optval > 0 && optval <= MAXTTL)
 +				if (optval >= 0 && optval <= MAXTTL)
  					inp->inp_ip_minttl = optval;
  				else
  					error = EINVAL;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: analyzed->patched 
State-Changed-By: rwatson 
State-Changed-When: Sat Jan 3 11:59:55 UTC 2009 
State-Changed-Why:  
Transition to patched state while awaiting MFC. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=128790 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/128790: commit references a PR
Date: Sun,  1 Feb 2009 19:20:56 +0000 (UTC)

 Author: rwatson
 Date: Sun Feb  1 19:20:45 2009
 New Revision: 187987
 URL: http://svn.freebsd.org/changeset/base/187987
 
 Log:
   Merge r186717 from head to stable/7:
   
      Allow the IP_MINTTL socket option to be set to 0 so that it can be
      disabled entirely, which is its default state before set to a
      non-zero value.
   
      PR:          128790
      Submitted by:        Nick Hilliard <nick at foobar dot org>
 
 Modified:
   stable/7/sys/   (props changed)
   stable/7/sys/contrib/pf/   (props changed)
   stable/7/sys/dev/ath/ath_hal/   (props changed)
   stable/7/sys/dev/cxgb/   (props changed)
   stable/7/sys/netinet/ip_output.c
 
 Modified: stable/7/sys/netinet/ip_output.c
 ==============================================================================
 --- stable/7/sys/netinet/ip_output.c	Sun Feb  1 18:10:06 2009	(r187986)
 +++ stable/7/sys/netinet/ip_output.c	Sun Feb  1 19:20:45 2009	(r187987)
 @@ -875,7 +875,7 @@ ip_ctloutput(struct socket *so, struct s
  				break;
  
  			case IP_MINTTL:
 -				if (optval > 0 && optval <= MAXTTL)
 +				if (optval >= 0 && optval <= MAXTTL)
  					inp->inp_ip_minttl = optval;
  				else
  					error = EINVAL;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/128790: commit references a PR
Date: Sun,  1 Feb 2009 20:18:40 +0000 (UTC)

 Author: rwatson
 Date: Sun Feb  1 20:18:27 2009
 New Revision: 187988
 URL: http://svn.freebsd.org/changeset/base/187988
 
 Log:
   Merge r187987 from stable/7 to stable/6:
   
     Merge r186717 from head to stable/7:
   
       Allow the IP_MINTTL socket option to be set to 0 so that it can be
       disabled entirely, which is its default state before set to a
       non-zero value.
   
       PR: 128790
       Submitted by: Nick Hilliard <nick at foobar dot org>
 
 Modified:
   stable/6/sys/   (props changed)
   stable/6/sys/contrib/pf/   (props changed)
   stable/6/sys/dev/cxgb/   (props changed)
   stable/6/sys/netinet/ip_output.c
 
 Modified: stable/6/sys/netinet/ip_output.c
 ==============================================================================
 --- stable/6/sys/netinet/ip_output.c	Sun Feb  1 19:20:45 2009	(r187987)
 +++ stable/6/sys/netinet/ip_output.c	Sun Feb  1 20:18:27 2009	(r187988)
 @@ -1255,7 +1255,7 @@ ip_ctloutput_pcbinfo(so, sopt, pcbinfo)
  				break;
  
  			case IP_MINTTL:
 -				if (optval > 0 && optval <= MAXTTL)
 +				if (optval >= 0 && optval <= MAXTTL)
  					inp->inp_ip_minttl = optval;
  				else
  					error = EINVAL;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: rwatson 
State-Changed-When: Sun Feb 1 20:20:27 UTC 2009 
State-Changed-Why:  
Close as the patch has now been merged to stable/7 and stable/6; it 
will appear in FreeBSD 7.2.  Thanks for the report and patch! 


http://www.freebsd.org/cgi/query-pr.cgi?pr=128790 
>Unformatted:
