Re: [PATCH net] ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

[Ido Schimmel <idosch@nvidia.com>]

On Mon, Jun 01, 2026 at 12:41:57PM +0000, Eric Dumazet wrote:
> This patch restricts setting Loose Source and Record Route (LSRR)
> and Strict Source and Record Route (SSRR) IP options to users
> with CAP_NET_RAW capability.
> 
> This prevents unprivileged applications from forcing packets to route
> through attacker-controlled nodes to leak TCP ISN and possibly other
> protocol information.
> 
> While LSRR and SSRR are commonly filtered in many network environments,
> they may still be supported and forwarded along some network paths.
> 
> RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing
> IPv4 Options) recommend to drop these options in 4.3 and 4.4.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Tamir Shahar <tamirthesis@gmail.com>
> Reported-by: Amit Klein <aksecurity@gmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv4/ip_options.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
> index be8815ce3ac242372eeae4a97091cda26d40ceb0..ac0d147c4b8cc347839a044adc43897faffd95c8 100644
> --- a/net/ipv4/ip_options.c
> +++ b/net/ipv4/ip_options.c
> @@ -283,6 +283,10 @@ int __ip_options_compile(struct net *net,
>  		switch (*optptr) {
>  		case IPOPT_SSRR:
>  		case IPOPT_LSRR:
> +			if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {
> +				pp_ptr = optptr;
> +				goto error;
> +			}

This might be a problem for netfilter which calls __ip_options_compile()
without an skb from ipv4_find_option().

AFAICT, user space can include IP options either using the IP_OPTIONS
socket options or using the IP_RETOPTS cmsg, but the latter is not
applicable to TCP.

If we put the check in do_ip_setsockopt(), we create a weird situation
for non-TCP sockets: They can't set these IP options using IP_OPTIONS,
but can set them via the IP_RETOPTS cmsg.

So maybe we should just put the check in ip_options_get() which is
called from both paths? Something like:

diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index be8815ce3ac2..09d745112c15 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -530,6 +530,10 @@ int ip_options_get(struct net *net, struct ip_options_rcu **optp,
                kfree(opt);
                return -EINVAL;
        }
+       if (opt->opt.srr && !ns_capable(net->user_ns, CAP_NET_RAW)) {
+               kfree(opt);
+               return -EPERM;
+       }
        kfree(*optp);
        *optp = opt;
        return 0;