diff options
| author |   Stephen Hemminger <shemminger@vyatta.com> | 2010-04-22 15:24:53 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2010-04-22 15:24:53 -0700 |
| commit | e802af9cabb011f09b9c19a82faef3dd315f27eb (patch) | |
| tree | 9a8ef1163b9b40fef8860b08ea4dcb4ff3916098 /include/linux/in6.h | |
| parent | net: Orphan and de-dst skbs earlier in xmit path. (diff) | |
| download | linux-dev-e802af9cabb011f09b9c19a82faef3dd315f27eb.tar.xz linux-dev-e802af9cabb011f09b9c19a82faef3dd315f27eb.zip | |
IPv6: Generic TTL Security Mechanism (final version)
This patch adds IPv6 support for RFC5082 Generalized TTL Security Mechanism.
Not to users of mapped address; the IPV6 and IPV4 socket options are seperate.
The server does have to deal with both IPv4 and IPv6 socket options
and the client has to handle the different for each family.
On client:
int ttl = 255;
getaddrinfo(argv[1], argv[2], &hint, &result);
for (rp = result; rp != NULL; rp = rp->ai_next) {
s = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
if (s < 0) continue;
if (rp->ai_family == AF_INET) {
setsockopt(s, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl));
} else if (rp->ai_family == AF_INET6) {
setsockopt(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS,
&ttl, sizeof(ttl)))
}
if (connect(s, rp->ai_addr, rp->ai_addrlen) == 0) {
...
On server:
int minttl = 255 - maxhops;
getaddrinfo(NULL, port, &hints, &result);
for (rp = result; rp != NULL; rp = rp->ai_next) {
s = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
if (s < 0) continue;
if (rp->ai_family == AF_INET6)
setsockopt(s, IPPROTO_IPV6, IPV6_MINHOPCOUNT,
&minttl, sizeof(minttl));
setsockopt(s, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl));
if (bind(s, rp->ai_addr, rp->ai_addrlen) == 0)
break
...
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/in6.h')
| -rw-r--r-- | include/linux/in6.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/in6.h b/include/linux/in6.h index bd55c6e46b2e..9b90cb296eb1 100644 --- a/include/linux/in6.h +++ b/include/linux/in6.h @@ -265,6 +265,9 @@ struct in6_flowlabel_req { #define IPV6_PREFER_SRC_CGA 0x0008 #define IPV6_PREFER_SRC_NONCGA 0x0800 +/* RFC5082: Generalized Ttl Security Mechanism */ +#define IPV6_MINHOPCOUNT 73 + /* * Multicast Routing: * see include/linux/mroute6.h. |