From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-we0-f171.google.com (mail-we0-f171.google.com [74.125.82.171]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 025BA20024C for ; Sun, 1 Apr 2012 10:19:59 -0700 (PDT) Received: by werm1 with SMTP id m1so2437307wer.16 for ; Sun, 01 Apr 2012 10:19:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=wz2fxVSRYSVZwTow/XtDZCHTbzqueRwYtDkEzZeGYbU=; b=So3YHwMP5Nb2LCTvrQBeiFZhLy5c5ygppF0Av1ESHI3NFg7tyVU7EqkxeerwKOk+n+ l7hH6fMFotDyBu3b6erYGhnDajvBdl4vb4aYGE64JX2GQZz0CZJxPmno2lVjgEB+bQTO nbCD6y9JOM/tUsc6ugcAo9KSjkYjHetKwVmpG+yFsxHwLzTimnYxTJ2YnI3ZnHfyraWe ndzP9YcYTuL5WqqIE6wKq3unkk/5HeXfxdclMb+i8TghvTkn7Ri5HtkoQ3szDsts0/d4 hPAASdiGZj9EsqnyDc+mnX7BT1MOxS4lV0QBFFHrn16aOMVnsNkA/EyrfTqKmkQzHiAN VZMA== MIME-Version: 1.0 Received: by 10.180.94.33 with SMTP id cz1mr16701448wib.13.1333300797659; Sun, 01 Apr 2012 10:19:57 -0700 (PDT) Received: by 10.223.127.194 with HTTP; Sun, 1 Apr 2012 10:19:57 -0700 (PDT) In-Reply-To: <1333284791-5363-1-git-send-email-martin@lucina.net> References: <1333284791-5363-1-git-send-email-martin@lucina.net> Date: Sun, 1 Apr 2012 18:19:57 +0100 Message-ID: From: Dave Taht To: cerowrt-devel@lists.bufferbloat.net Content-Type: multipart/alternative; boundary=f46d044268e66c59b104bca14870 Subject: [Cerowrt-devel] Fwd: [PATCH] Implement IP_EVIL socket option (RFC 3514) X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Apr 2012 17:20:00 -0000 --f46d044268e66c59b104bca14870 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable You know, I really, really hate not having used up all the bits in the ip header. There is some encouraging work in the conex working group http://datatracker.ietf.org/wg/conex/charter/ that needs this bit in order to implement at least part of their core idea. So I think today would be a good day to commit to using up that last bit in cerowrt. ---------- Forwarded message ---------- From: Martin Lucina Date: Sun, Apr 1, 2012 at 1:53 PM Subject: [PATCH] Implement IP_EVIL socket option (RFC 3514) To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Cc: Martin Lucina This patch implements the IP_EVIL socket option, allowing user-space applications to set the Security Flag in the IPv4 Header, aka "evil" bit, as defined in RFC 3514. Signed-off-by: Martin Lucina --- include/linux/in.h | 1 + include/net/inet_sock.h | 1 + net/ipv4/af_inet.c | 1 + net/ipv4/ip_output.c | 2 ++ net/ipv4/ip_sockglue.c | 9 ++++++++- 5 files changed, 13 insertions(+), 1 deletions(-) diff --git a/include/linux/in.h b/include/linux/in.h index e0337f1..6814c0f 100644 --- a/include/linux/in.h +++ b/include/linux/in.h @@ -86,6 +86,7 @@ struct in_addr { #define IP_MINTTL 21 #define IP_NODEFRAG 22 +#define IP_EVIL 23 /* IP_MTU_DISCOVER values */ #define IP_PMTUDISC_DONT 0 /* Never send DF frames */ diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h index ae17e13..37aaf9b 100644 --- a/include/net/inet_sock.h +++ b/include/net/inet_sock.h @@ -168,6 +168,7 @@ struct inet_sock { transparent:1, mc_all:1, nodefrag:1; + __u8 evil; __u8 rcv_tos; int uc_index; int mc_index; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 10e3751..b165dfb 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -356,6 +356,7 @@ lookup_protocol: inet->is_icsk =3D (INET_PROTOSW_ICSK & answer_flags) !=3D 0; inet->nodefrag =3D 0; + inet->evil =3D 0; /* Don't be evil */ if (SOCK_RAW =3D=3D sock->type) { inet->inet_num =3D protocol; diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 4910176..c1b4b15 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -157,6 +157,8 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk, iph->frag_off =3D htons(IP_DF); else iph->frag_off =3D 0; + if (inet->evil) + iph->frag_off |=3D 1<<15; iph->ttl =3D ip_select_ttl(inet, &rt->dst); iph->daddr =3D (opt && opt->opt.srr ? opt->opt.faddr : daddr); iph->saddr =3D saddr; diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 2fd0fba..f26d45c 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -463,7 +463,8 @@ static int do_ip_setsockopt(struct sock *sk, int level, (1<nodefrag =3D val ? 1 : 0; break; + case IP_EVIL: + inet->evil =3D val ? 1 : 0; + break; case IP_MTU_DISCOVER: if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE) goto e_inval; @@ -1176,6 +1180,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, case IP_NODEFRAG: val =3D inet->nodefrag; break; + case IP_EVIL: + val =3D inet->evil; + break; case IP_MTU_DISCOVER: val =3D inet->pmtudisc; break; -- 1.7.9.1 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --=20 Dave T=E4ht SKYPE: davetaht US Tel: 1-239-829-5608 http://www.bufferbloat.net --f46d044268e66c59b104bca14870 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable You know, I really, really hate not having used up all the bits in the ip h= eader.

There is some encouraging work in the conex working group
http://datat= racker.ietf.org/wg/conex/charter/

that needs this bit in order to implement at least part of their core i= dea.

So I think today would be a good day to commit to using up that= last bit in cerowrt.

---------- Forwarde= d message ----------
From: Martin Lucina <= ;martin@lucina.net>
D= ate: Sun, Apr 1, 2012 at 1:53 PM
Subject: [PATCH] Implement IP_EVIL sock= et option (RFC 3514)
To: linux-kernel@vger.kerne= l.org, netdev@vger.kernel.org=
Cc: Martin Lucina <martin@l= ucina.net>


This patch implements the IP_EVIL socket option, allowing user-spac= e
applications to set the Security Flag in the IPv4 Header, aka "evil&qu= ot; bit,
as defined in RFC 3514.

Signed-off-by: Martin Lucina <marti= n@lucina.net>
---
=A0include/linux/in.h =A0 =A0 =A0| =A0 =A01 +
=A0include/net/inet_sock.h | =A0 =A01 +
=A0net/ipv4/af_inet.c =A0 =A0 =A0| =A0 =A01 +
=A0net/ipv4/ip_output.c =A0 =A0| =A0 =A02 ++
=A0net/ipv4/ip_sockglue.c =A0| =A0 =A09 ++++++++-
=A05 files changed, 13 insertions(+), 1 deletions(-)

diff --git a/include/linux/in.h b/include/linux/in.h
index e0337f1..6814c0f 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -86,6 +86,7 @@ struct in_addr {

=A0#define IP_MINTTL =A0 =A0 =A0 21
=A0#define IP_NODEFRAG =A0 =A0 22
+#define IP_EVIL =A0 =A0 =A0 =A0 23

=A0/* IP_MTU_DISCOVER values */
=A0#define IP_PMTUDISC_DONT =A0 =A0 =A0 =A0 =A0 =A0 =A0 0 =A0 =A0 =A0 /* Ne= ver send DF frames */
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index ae17e13..37aaf9b 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -168,6 +168,7 @@ struct inet_sock {
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0transparent= :1,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0mc_all:1, =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0nodefrag:1;=
+ =A0 =A0 =A0 __u8 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0evil;
=A0 =A0 =A0 =A0__u8 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0rcv_tos;
=A0 =A0 =A0 =A0int =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 uc_index;
=A0 =A0 =A0 =A0int =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 mc_index;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 10e3751..b165dfb 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -356,6 +356,7 @@ lookup_protocol:
=A0 =A0 =A0 =A0inet->is_icsk =3D (INET_PROTOSW_ICSK & answer_flags)= !=3D 0;

=A0 =A0 =A0 =A0inet->nodefrag =3D 0;
+ =A0 =A0 =A0 inet->evil =3D 0; /* Don't be evil */

=A0 =A0 =A0 =A0if (SOCK_RAW =3D=3D sock->type) {
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0inet->inet_num =3D protocol;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4910176..c1b4b15 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -157,6 +157,8 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct s= ock *sk,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0iph->frag_off =3D htons(IP_DF);
=A0 =A0 =A0 =A0else
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0iph->frag_off =3D 0;
+ =A0 =A0 =A0 if (inet->evil)
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 iph->frag_off |=3D 1<<15;
=A0 =A0 =A0 =A0iph->ttl =A0 =A0 =A0=3D ip_select_ttl(inet, &rt->= dst);
=A0 =A0 =A0 =A0iph->daddr =A0 =A0=3D (opt && opt->opt.srr ? = opt->opt.faddr : daddr);
=A0 =A0 =A0 =A0iph->saddr =A0 =A0=3D saddr;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 2fd0fba..f26d45c 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -463,7 +463,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 (1<<IP_MTU_D= ISCOVER) | (1<<IP_RECVERR) |
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 (1<<IP_ROUTE= R_ALERT) | (1<<IP_FREEBIND) |
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 (1<<IP_PASSS= EC) | (1<<IP_TRANSPARENT) |
- =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0(1<<IP_MINTT= L) | (1<<IP_NODEFRAG))) ||
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0(1<<IP_MINTT= L) | (1<<IP_NODEFRAG) |
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0(1<<IP_EVIL)= )) ||
=A0 =A0 =A0 =A0 =A0 =A0optname =3D=3D IP_UNICAST_IF ||
=A0 =A0 =A0 =A0 =A0 =A0optname =3D=3D IP_MULTICAST_TTL ||
=A0 =A0 =A0 =A0 =A0 =A0optname =3D=3D IP_MULTICAST_ALL ||
@@ -598,6 +599,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0}
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0inet->nodefrag =3D val ? 1 : 0;
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0break;
+ =A0 =A0 =A0 case IP_EVIL:
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 inet->evil =3D val ? 1 : 0;
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 break;
=A0 =A0 =A0 =A0case IP_MTU_DISCOVER:
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0if (val < IP_PMTUDISC_DONT || val > I= P_PMTUDISC_PROBE)
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0goto e_inval;
@@ -1176,6 +1180,9 @@ static int do_ip_getsockopt(struct sock *sk, int leve= l, int optname,
=A0 =A0 =A0 =A0case IP_NODEFRAG:
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0val =3D inet->nodefrag;
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0break;
+ =A0 =A0 =A0 case IP_EVIL:
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 val =3D inet->evil;
+ =A0 =A0 =A0 =A0 =A0 =A0 =A0 break;
=A0 =A0 =A0 =A0case IP_MTU_DISCOVER:
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0val =3D inet->pmtudisc;
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0break;
--
1.7.9.1

--
To unsubscribe from this list: send the line "unsubscribe netdev"= in
the body of a message to major= domo@vger.kernel.org
More majordomo info at =A0http://vger.kernel.org/majordomo-info.html



--
Dave T=E4ht
SKYPE: = davetaht
US Tel: 1-239-829-5608
http://www.bufferbloat.net
--f46d044268e66c59b104bca14870--