path: root/net/dccp/ipv4.c
diff options
authorHannes Frederic Sowa <hannes@stressinduktion.org>2014-01-09 10:01:17 +0100
committerDavid S. Miller <davem@davemloft.net>2014-01-13 11:22:55 -0800
commit8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e (patch)
tree4a8093c0dfa1507ce234754a54db8a95399955a4 /net/dccp/ipv4.c
parentipv6: introduce ip6_dst_mtu_forward and protect forwarding path with it (diff)
ipv4: introduce hardened ip_no_pmtu_disc mode
This new ip_no_pmtu_disc mode only allowes fragmentation-needed errors to be honored by protocols which do more stringent validation on the ICMP's packet payload. This knob is useful for people who e.g. want to run an unmodified DNS server in a namespace where they need to use pmtu for TCP connections (as they are used for zone transfers or fallback for requests) but don't want to use possibly spoofed UDP pmtu information. Currently the whitelisted protocols are TCP, SCTP and DCCP as they check if the returned packet is in the window or if the association is valid. Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: David Miller <davem@davemloft.net> Cc: John Heffner <johnwheffner@gmail.com> Suggested-by: Florian Weimer <fweimer@redhat.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
1 files changed, 1 insertions, 0 deletions
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 88299c29101d..22b5d818b200 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -989,6 +989,7 @@ static const struct net_protocol dccp_v4_protocol = {
.err_handler = dccp_v4_err,
.no_policy = 1,
.netns_ok = 1,
+ .icmp_strict_tag_validation = 1,
static const struct proto_ops inet_dccp_ops = {