net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
According to RFC 1191 sections 3 and 4, ICMP frag-needed messages indicating an MTU below 68 should be rejected: A host MUST never reduce its estimate of the Path MTU below 68 octets. and (talking about ICMP frag-needed's Next-Hop MTU field): This field will never contain a value less than 68, since every router "must be able to forward a datagram of 68 octets without fragmentation". Furthermore, by letting net.ipv4.route.min_pmtu be set to negative values, we can end up with a very large PMTU when (-1) is cast into u32. Let's also make ip_rt_min_pmtu a u32, since it's only ever compared to unsigned ints. Reported-by: Jianlin Shi <jishi@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
68b116a28f
commit
c7272c2f12
|
@ -128,10 +128,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1));
|
|||
static int ip_rt_error_cost __read_mostly = HZ;
|
||||
static int ip_rt_error_burst __read_mostly = 5 * HZ;
|
||||
static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ;
|
||||
static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20;
|
||||
static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20;
|
||||
static int ip_rt_min_advmss __read_mostly = 256;
|
||||
|
||||
static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT;
|
||||
|
||||
static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU;
|
||||
|
||||
/*
|
||||
* Interface to generic destination cache.
|
||||
*/
|
||||
|
@ -2933,7 +2936,8 @@ static struct ctl_table ipv4_route_table[] = {
|
|||
.data = &ip_rt_min_pmtu,
|
||||
.maxlen = sizeof(int),
|
||||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec,
|
||||
.proc_handler = proc_dointvec_minmax,
|
||||
.extra1 = &ip_min_valid_pmtu,
|
||||
},
|
||||
{
|
||||
.procname = "min_adv_mss",
|
||||
|
|
Loading…
Reference in a new issue