Re: [RFC] TTL target goes mainline ?

[Patrick McHardy <kaber@trash.net>]

Harald Welte wrote:
> Hi!
> 
> As we are in the process of pushing more 'new' code from
> patch-o-matic-ng into the mainline kernel, I was thinking whether or not
> we should also submit potentially-dangerous targets such as the TTL
> target to the kernel.
> 
> The TTL target allows setting, incrementing and decrementing of the TTL,
> and is therefore extremely dangerous. OTOTH, there are ISP's that check
> whether you use a router or not (and thus filter or not) by looking at
> the TTL of every packet that comes in on your link - so there is a
> practical use of this to a number of people.
> 
> At some point the kernel had a CONFIG_DANGEROUS, but that had been
> removed. I think CONFIG_DANGEROUS would be exactly the right thing for
> TTL manipulations.
> 
> So my proposal is to only allow decrementing (or setting to a value
> below the original one) the TTL unless CONFIG_EXPERIMENTAL is set. 

Why not, people can just as easy shoot themselves using bridging or
tc actions. But I'm not sure about enabling only parts of functionality
without CONFIG_EXPERIMENTAL, why not simply depend entirely on it?