• Stephen Hemminger's avatar
    IPv6: Generic TTL Security Mechanism (final version) · e802af9c
    Stephen Hemminger authored
    This patch adds IPv6 support for RFC5082 Generalized TTL Security Mechanism.  
    
    Not to users of mapped address; the IPV6 and IPV4 socket options are seperate.
    The server does have to deal with both IPv4 and IPv6 socket options
    and the client has to handle the different for each family.
    
    On client:
    	int ttl = 255;
    	getaddrinfo(argv[1], argv[2], &hint, &result);
    
    	for (rp = result; rp != NULL; rp = rp->ai_next) {
    		s = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
    		if (s < 0) continue;
    
    		if (rp->ai_family == AF_INET) {
    			setsockopt(s, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl));
    		} else if (rp->ai_family == AF_INET6) {
    			setsockopt(s, IPPROTO_IPV6,  IPV6_UNICAST_HOPS, 
    					&ttl, sizeof(ttl)))
    		}
    			
    		if (connect(s, rp->ai_addr, rp->ai_addrlen) == 0) {
    		   ...
    
    On server:
    	int minttl = 255 - maxhops;
       
    	getaddrinfo(NULL, port, &hints, &result);
    	for (rp = result; rp != NULL; rp = rp->ai_next) {
    		s = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
    		if (s < 0) continue;
    
    		if (rp->ai_family == AF_INET6)
    			setsockopt(s, IPPROTO_IPV6,  IPV6_MINHOPCOUNT,
    					&minttl, sizeof(minttl));
    		setsockopt(s, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl));
    			
    		if (bind(s, rp->ai_addr, rp->ai_addrlen) == 0)
    			break
    ...
    Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e802af9c
in6.h 7.07 KB