IP_MINTTL is not working on raw socket

Question

We are implementing TTL security feature to OSPF. As part of this, We need to validate the incoming ospf packets based on ttl value.

For this, we are using IP_MINTTL socket option to validate the incoming packets. But we are observing that packets are not getting dropped irrespective of TTL value.

As we use raw socket for ospf to receive and send, setting this IP_MINTTL on this socket.

But it is not working , Is this option works for RAW sockets? Please help me to understand this ?

We are using linux 4.18 kernel version.

Regards, Rajesh.

Answer 1

From this 2010 LWN article (meanwhile features might have improved or were already complete for *BSD, but apparently nothing changed for Linux):

The Linux patch is rather simple and the implementation is the same as that for BSD kernels. A new option (IP_MINTTL) is added that can be used with setsockopt() to change the minimum TTL for a socket. If set, the TCP code checks the value and discards packets that have smaller TTLs. The patch does not add support for various other protocols (e.g. UDP) nor for the IPv6 equivalent, which is IPV6_MINHOPLIMIT.

it appears on Linux this option has an effect only on TCP sockets. a RAW socket, even if receiving TCP packets, isn't a TCP socket.

The relevant kernel code about IP_MINTTL on kernel 5.18 (you'll have to check your distribution for 4.18) can be found by using this command in the kernel source:

$ grep -Ewrl 'IP_MINTTL|min_ttl'  net
net/netrom/sysctl_net_netrom.c
net/mptcp/sockopt.c
net/ipv4/tcp_ipv4.c
net/ipv4/ip_sockglue.c

ip_sockglue.c handles the socket option itself, but the only place doing actual comparison with packet content is done in tcp_ipv4.c (the same following block appears twice almost identically in this file):

  if (static_branch_unlikely(&ip4_min_ttl)) {
      /* min_ttl can be changed concurrently from do_ip_setsockopt() */
      if (unlikely(iph->ttl < READ_ONCE(inet_sk(sk)->min_ttl))) {
          __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
          goto discard_and_relse;
      }
  }

meaning nothing has changed since the 2010 LWN article.

Possible workaround: firewall rules. See iptables's IPv4 ttl match or nftables's IPv4 ttl expression. "AF_INET, SOCK_RAW" sockets should be fine but not "AF_PACKET, SOCK_RAW" which would receive data before firewall rules happen (anyway IP_MINTTL should apply only to former).