net: ipv6: restrict hop_limit sysctl setting to range [1; 255] (d6df198d) · Commits · 戴 / test

Setting a value bigger than 255 resulted in using only the lower eight bits of that value as it is assigned to the u8 header field. To avoid this unexpected result, reject such values. Setting a value of zero is technically possible, but hosts receiving such a packet have to treat it like hop_limit was set to one, according to RFC2460. Therefore I don't see a use-case for that. Setting a route's hop_limit to zero in iproute2 means to use the sysctl default, which is not the case here: Setting e.g. net.conf.eth0.hop_limit=0 will not make the kernel use net.conf.all.hop_limit for outgoing packets on eth0. To avoid these kinds of confusion, reject zero. Signed-off-by:

Phil Sutter <phil@nwl.cc> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/addrconf.c

+15 −1

Original line number	Original line	Diff line number	Diff line
	@@ -5199,6 +5199,20 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
	return ret;		return ret;
	}		}

			static
			int addrconf_sysctl_hop_limit(struct ctl_table *ctl, int write,
			void __user buffer, size_t lenp, loff_t *ppos)
			{
			struct ctl_table lctl;
			int min_hl = 1, max_hl = 255;

			lctl = *ctl;
			lctl.extra1 = &min_hl;
			lctl.extra2 = &max_hl;

			return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
			}

	static		static
	int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,		int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
	void __user buffer, size_t lenp, loff_t *ppos)		void __user buffer, size_t lenp, loff_t *ppos)
	@@ -5454,7 +5468,7 @@ static struct addrconf_sysctl_table
	.data = &ipv6_devconf.hop_limit,		.data = &ipv6_devconf.hop_limit,
	.maxlen = sizeof(int),		.maxlen = sizeof(int),
	.mode = 0644,		.mode = 0644,
	.proc_handler = proc_dointvec,		.proc_handler = addrconf_sysctl_hop_limit,
	},		},
	{		{
	.procname = "mtu",		.procname = "mtu",

Admin message