kern/128790: [patch] bug in IP_MINTTL setsockopt() implementation

[Nick Hilliard]

>Number:         128790
>Category:       kern
>Synopsis:       [patch] bug in IP_MINTTL setsockopt() implementation
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Nov 11 15:40:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Nick Hilliard
>Release:        FreeBSD 6.1-RELEASE i386
>Organization:
Network Ability Ltd
>Environment:
System: FreeBSD xx 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Wed May 17 11:38:53 IST 2006 nick at xxx:/data/src/usr.src/src-6.1/src/sys/i386/compile/xxx i386

>Description:

The IP_MINTTL socket option allows implementation of GTSM - RFC 5082.  This
is useful for BGP session security, and is implemented in OpenBGPD 4.3.

>From perusing the kernel code, you can set inp->inp_ip_minttl to any value
between 1 and MAXTTL (i.e. 255).  These are permissable TTL values. 
However, when setting up the inp structure, inp_ip_minttl will be
initialised to zero.  Also, there are various checks in
/sys/netinet/raw_ip.c, /sys/netinet/tcp_input.c and
/sys/netinet/udp_usrreq.c which only perform a MINTTL check if
inp->inp_ip_minttl is set to nonzero.  This suggests that zero is a valid
value for inp_ip_minttl.

However, there is a bug in the implementation on {free,open,dragonfly}bsd
which prevents a programmer from calling the setsockopt() IP_MINTTL with a
value of zero.

Patch below to fix this behaviour.

>How-To-Repeat:

	int minttl = 0;
	ret = setsockopt (sock, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl));

	[expect ret == -1]

>Fix:

--- /sys/netinet/ip_output.c~	2008-11-03 15:22:39.000000000 +0000
+++ /sys/netinet/ip_output.c	2008-11-03 15:22:39.000000000 +0000
@@ -865,7 +865,7 @@
 				break;
 
 			case IP_MINTTL:
-				if (optval > 0 && optval <= MAXTTL)
+				if (optval >= 0 && optval <= MAXTTL)
 					inp->inp_ip_minttl = optval;
 				else
 					error = EINVAL;


>Release-Note:
>Audit-Trail:
>Unformatted: