set_interface_var() doesn't check interface name and blindly does
fopen(path "/" ifname, "w") on it.  As "ifname" is an untrusted input, it
should be checked for ".." and/or "/" in it.  Otherwise, an infected
unprivileged daemon may overwrite contents of file named "mtu",
"hoplimit", etc. in arbitrary location with arbitrary 32-bit value in
decimal representation ("%d").  If an attacker has a local account or
may create arbitrary symlinks with these names in any location (e.g.
/tmp), any file may be overwritten with a decimal value.
set_interface_retranstimer(const char *iface, uint32_t rettimer)
{
	int ret;

	if (privsep_enabled())
		return privsep_interface_retranstimer(iface, rettimer);

	ret = set_interface_var(iface,
				PROC_SYS_IP6_RETRANSTIMER_MS,
				NULL,
				rettimer);
	if (ret)
		ret = set_interface_var(iface,
					PROC_SYS_IP6_RETRANSTIMER,
					"RetransTimer",
					rettimer / 1000 * USER_HZ); /* XXX user_hz */
	return ret;
}

set_interface_retranstimer(const char *iface, uint32_t rettimer)
{
	int ret;

	if (privsep_enabled())
		return privsep_interface_retranstimer(iface, rettimer);

	ret = set_interface_var(iface,
				PROC_SYS_IP6_RETRANSTIMER_MS,
				NULL,
				rettimer);
	if (ret)
		ret = set_interface_var(iface,
					PROC_SYS_IP6_RETRANSTIMER,
					"RetransTimer",
					rettimer / 1000 * USER_HZ); /* XXX user_hz */
	return ret;
}
