History

ipv6: sysctl to restrict candidate source addresses

Per RFC 6724, section 4, "Candidate Source Addresses": It is RECOMMENDED that the candidate source addresses be the set of unicast addresses assigned to the interface that will be used to send to the destination (the "outgoing" interface). Add a sysctl to enable this behaviour.

Erik Kline committed 11 years ago

Commit 3985e8a1 parent fb02eb44 files · +28 −3Browse files

Unified · Split

4 files
  1. Documentation/networking/ip-sysctl.txt +7 −0
  2. include/linux/ipv6.h +1 −0
  3. include/uapi/linux/ipv6.h +1 −0
  4. net/ipv6/addrconf.c +19 −3
Documentation/networking/ip-sysctl.txt+7−0
@@ -1460,6 +1460,13 @@ router_solicitations - INTEGER · 1459 unmodified lines
14601460 routers are present.
14611461 Default: 3
14621462
1463+use_oif_addrs_only - BOOLEAN
1464+ When enabled, the candidate source addresses for destinations
1465+ routed via this interface are restricted to the set of addresses
1466+ configured on this interface (vis. RFC 6724, section 4).
1467+
1468+ Default: false
1469+
14631470 use_tempaddr - INTEGER
14641471 Preference for Privacy Extensions (RFC3041).
14651472 <= 0 : disable Privacy Extensions
include/linux/ipv6.h+1−0
@@ -57,6 +57,7 @@ struct ipv6_devconf { · 56 unmodified lines
5757 bool initialized;
5858 struct in6_addr secret;
5959 } stable_secret;
60+ __s32 use_oif_addrs_only;
6061 void *sysctl;
6162 };
6263
include/uapi/linux/ipv6.h+1−0
@@ -171,6 +171,7 @@ enum { · 170 unmodified lines
171171 DEVCONF_USE_OPTIMISTIC,
172172 DEVCONF_ACCEPT_RA_MTU,
173173 DEVCONF_STABLE_SECRET,
174+ DEVCONF_USE_OIF_ADDRS_ONLY,
174175 DEVCONF_MAX
175176 };
176177
net/ipv6/addrconf.c+19−3
@@ -211,7 +211,8 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { · 210 unmodified lines
211211 .accept_ra_mtu = 1,
212212 .stable_secret = {
213213 .initialized = false,
214− }
214+ },
215+ .use_oif_addrs_only = 0,
215216 };
216217
217218 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -253,6 +254,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { · 35 unmodified lines
253254 .stable_secret = {
254255 .initialized = false,
255256 },
257+ .use_oif_addrs_only = 0,
256258 };
257259
258260 /* Check if a valid qdisc is available */
@@ -1472,11 +1474,16 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, · 1213 unmodified lines
14721474 * include addresses assigned to interfaces
14731475 * belonging to the same site as the outgoing
14741476 * interface.)
1477+ * - "It is RECOMMENDED that the candidate source addresses
1478+ * be the set of unicast addresses assigned to the
1479+ * interface that will be used to send to the destination
1480+ * (the 'outgoing' interface)." (RFC 6724)
14751481 */
14761482 if (dst_dev) {
1483+ idev = __in6_dev_get(dst_dev);
14771484 if ((dst_type & IPV6_ADDR_MULTICAST) ||
1478− dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) {
1479− idev = __in6_dev_get(dst_dev);
1485+ dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
1486+ (idev && idev->cnf.use_oif_addrs_only)) {
14801487 use_oif_addr = true;
14811488 }
14821489 }
@@ -4607,6 +4614,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, · 3124 unmodified lines
46074614 array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
46084615 array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
46094616 /* we omit DEVCONF_STABLE_SECRET for now */
4617+ array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
46104618 }
46114619
46124620 static inline size_t inet6_ifla6_size(void)
@@ -5605,6 +5613,14 @@ static struct addrconf_sysctl_table · 992 unmodified lines
56055613 .mode = 0600,
56065614 .proc_handler = addrconf_sysctl_stable_secret,
56075615 },
5616+ {
5617+ .procname = "use_oif_addrs_only",
5618+ .data = &ipv6_devconf.use_oif_addrs_only,
5619+ .maxlen = sizeof(int),
5620+ .mode = 0644,
5621+ .proc_handler = proc_dointvec,
5622+
5623+ },
56085624 {
56095625 /* sentinel */
56105626 }