diff --git a/CHANGES b/CHANGES index 6d2a8b87c8..99cd8aee32 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ +4505. [port] Use IP_PMTUDISC_OMIT if available. [RT #35494] + 4504. [security] Allow the maximum number of records in a zone to be specified. This provides a control for issues raised in CVE-2016-6170. [RT #42143] diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index 3f32161a2d..a4a4cd09b9 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -2858,11 +2858,24 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock, #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) /* * Turn off Path MTU discovery on IPv4/UDP sockets. + * Prefer IP_PMTUDISC_OMIT over IP_PMTUDISC_DONT + * if it available. */ if (sock->pf == AF_INET) { - int action = IP_PMTUDISC_DONT; - (void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER, - &action, sizeof(action)); + int action; +#ifdef defined(IP_PMTUDISC_OMIT) + action = IP_PMTUDISC_OMIT; + if (setsockopt(sock->fd, IPPROTO_IPV6, + IPV6_MTU_DISCOVER, &action, + sizeof(action)) < 0) { +#endif + action = IP_PMTUDISC_DONT; + (void)setsockopt(sock->fd, IPPROTO_IP, + IP_MTU_DISCOVER, + &action, sizeof(action)); +#ifdef defined(IP_PMTUDISC_OMIT) + } +#endif } #endif #if defined(IP_DONTFRAG)