• Hannes Frederic Sowa's avatar
    ipv4: introduce hardened ip_no_pmtu_disc mode · 8ed1dc44
    Hannes Frederic Sowa authored
    This new ip_no_pmtu_disc mode only allowes fragmentation-needed errors
    to be honored by protocols which do more stringent validation on the
    ICMP's packet payload. This knob is useful for people who e.g. want to
    run an unmodified DNS server in a namespace where they need to use pmtu
    for TCP connections (as they are used for zone transfers or fallback
    for requests) but don't want to use possibly spoofed UDP pmtu information.
    
    Currently the whitelisted protocols are TCP, SCTP and DCCP as they check
    if the returned packet is in the window or if the association is valid.
    
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: David Miller <davem@davemloft.net>
    Cc: John Heffner <johnwheffner@gmail.com>
    Suggested-by: default avatarFlorian Weimer <fweimer@redhat.com>
    Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    8ed1dc44
protocol.c 41.4 KB