You know, I really, really hate not having used up all the bits in the ip header.<br><br>There is some encouraging work in the conex working group <br><br><a href="http://datatracker.ietf.org/wg/conex/charter/">http://datatracker.ietf.org/wg/conex/charter/</a><br>
<br>that needs this bit in order to implement at least part of their core idea.<br><br>So I think today would be a good day to commit to using up that last bit in cerowrt.<br><br><div class="gmail_quote">---------- Forwarded message ----------<br>
From: <b class="gmail_sendername">Martin Lucina</b> <span dir="ltr"><<a href="mailto:martin@lucina.net">martin@lucina.net</a>></span><br>Date: Sun, Apr 1, 2012 at 1:53 PM<br>Subject: [PATCH] Implement IP_EVIL socket option (RFC 3514)<br>
To: <a href="mailto:linux-kernel@vger.kernel.org">linux-kernel@vger.kernel.org</a>, <a href="mailto:netdev@vger.kernel.org">netdev@vger.kernel.org</a><br>Cc: Martin Lucina <<a href="mailto:martin@lucina.net">martin@lucina.net</a>><br>
<br><br>This patch implements the IP_EVIL socket option, allowing user-space<br>
applications to set the Security Flag in the IPv4 Header, aka "evil" bit,<br>
as defined in RFC 3514.<br>
<br>
Signed-off-by: Martin Lucina <<a href="mailto:martin@lucina.net">martin@lucina.net</a>><br>
---<br>
include/linux/in.h | 1 +<br>
include/net/inet_sock.h | 1 +<br>
net/ipv4/af_inet.c | 1 +<br>
net/ipv4/ip_output.c | 2 ++<br>
net/ipv4/ip_sockglue.c | 9 ++++++++-<br>
5 files changed, 13 insertions(+), 1 deletions(-)<br>
<br>
diff --git a/include/linux/in.h b/include/linux/in.h<br>
index e0337f1..6814c0f 100644<br>
--- a/include/linux/in.h<br>
+++ b/include/linux/in.h<br>
@@ -86,6 +86,7 @@ struct in_addr {<br>
<br>
#define IP_MINTTL 21<br>
#define IP_NODEFRAG 22<br>
+#define IP_EVIL 23<br>
<br>
/* IP_MTU_DISCOVER values */<br>
#define IP_PMTUDISC_DONT 0 /* Never send DF frames */<br>
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h<br>
index ae17e13..37aaf9b 100644<br>
--- a/include/net/inet_sock.h<br>
+++ b/include/net/inet_sock.h<br>
@@ -168,6 +168,7 @@ struct inet_sock {<br>
transparent:1,<br>
mc_all:1,<br>
nodefrag:1;<br>
+ __u8 evil;<br>
__u8 rcv_tos;<br>
int uc_index;<br>
int mc_index;<br>
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c<br>
index 10e3751..b165dfb 100644<br>
--- a/net/ipv4/af_inet.c<br>
+++ b/net/ipv4/af_inet.c<br>
@@ -356,6 +356,7 @@ lookup_protocol:<br>
inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;<br>
<br>
inet->nodefrag = 0;<br>
+ inet->evil = 0; /* Don't be evil */<br>
<br>
if (SOCK_RAW == sock->type) {<br>
inet->inet_num = protocol;<br>
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c<br>
index 4910176..c1b4b15 100644<br>
--- a/net/ipv4/ip_output.c<br>
+++ b/net/ipv4/ip_output.c<br>
@@ -157,6 +157,8 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,<br>
iph->frag_off = htons(IP_DF);<br>
else<br>
iph->frag_off = 0;<br>
+ if (inet->evil)<br>
+ iph->frag_off |= 1<<15;<br>
iph->ttl = ip_select_ttl(inet, &rt->dst);<br>
iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);<br>
iph->saddr = saddr;<br>
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c<br>
index 2fd0fba..f26d45c 100644<br>
--- a/net/ipv4/ip_sockglue.c<br>
+++ b/net/ipv4/ip_sockglue.c<br>
@@ -463,7 +463,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,<br>
(1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |<br>
(1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |<br>
(1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |<br>
- (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||<br>
+ (1<<IP_MINTTL) | (1<<IP_NODEFRAG) |<br>
+ (1<<IP_EVIL))) ||<br>
optname == IP_UNICAST_IF ||<br>
optname == IP_MULTICAST_TTL ||<br>
optname == IP_MULTICAST_ALL ||<br>
@@ -598,6 +599,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,<br>
}<br>
inet->nodefrag = val ? 1 : 0;<br>
break;<br>
+ case IP_EVIL:<br>
+ inet->evil = val ? 1 : 0;<br>
+ break;<br>
case IP_MTU_DISCOVER:<br>
if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)<br>
goto e_inval;<br>
@@ -1176,6 +1180,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,<br>
case IP_NODEFRAG:<br>
val = inet->nodefrag;<br>
break;<br>
+ case IP_EVIL:<br>
+ val = inet->evil;<br>
+ break;<br>
case IP_MTU_DISCOVER:<br>
val = inet->pmtudisc;<br>
break;<br>
<span class="HOEnZb"><font color="#888888">--<br>
1.7.9.1<br>
<br>
--<br>
To unsubscribe from this list: send the line "unsubscribe netdev" in<br>
the body of a message to <a href="mailto:majordomo@vger.kernel.org">majordomo@vger.kernel.org</a><br>
More majordomo info at <a href="http://vger.kernel.org/majordomo-info.html" target="_blank">http://vger.kernel.org/majordomo-info.html</a><br>
</font></span></div><br><br clear="all"><br>-- <br>Dave Täht<br>SKYPE: davetaht<br>US Tel: 1-239-829-5608<br><a href="http://www.bufferbloat.net" target="_blank">http://www.bufferbloat.net</a><br>