ipv6: sysctl to restrict candidate source addresses

Per RFC 6724, section 4, "Candidate Source Addresses": It is RECOMMENDED that the candidate source addresses be the set of unicast addresses assigned to the interface that will be used to send to the destination (the "outgoing" interface). Add a sysctl to enable this behaviour.

Erik Kline committed 11 years ago

Commit 3985e8a1 parent fb02eb44 files · +28 −3Browse files

Unified · Split

4 files

Documentation/networking/ip-sysctl.txt +7 −0
include/linux/ipv6.h +1 −0
include/uapi/linux/ipv6.h +1 −0
net/ipv6/addrconf.c +19 −3

Documentation/networking/ip-sysctl.txt+7−0

@@ -1460,6 +1460,13 @@ router_solicitations - INTEGER · 1459 unmodified lines
1460	routers are present.	1460	routers are present.
1461	Default: 3	1461	Default: 3
1462		1462
		1463	use_oif_addrs_only - BOOLEAN
		1464	When enabled, the candidate source addresses for destinations
		1465	routed via this interface are restricted to the set of addresses
		1466	configured on this interface (vis. RFC 6724, section 4).
		1467
		1468	Default: false
		1469
1463	use_tempaddr - INTEGER	1470	use_tempaddr - INTEGER
1464	Preference for Privacy Extensions (RFC3041).	1471	Preference for Privacy Extensions (RFC3041).
1465	<= 0 : disable Privacy Extensions	1472	<= 0 : disable Privacy Extensions

include/linux/ipv6.h+1−0

@@ -57,6 +57,7 @@ struct ipv6_devconf { · 56 unmodified lines
57	bool initialized;	57	bool initialized;
58	struct in6_addr secret;	58	struct in6_addr secret;
59	} stable_secret;	59	} stable_secret;
		60	__s32 use_oif_addrs_only;
60	void *sysctl;	61	void *sysctl;
61	};	62	};
62		63

include/uapi/linux/ipv6.h+1−0

@@ -171,6 +171,7 @@ enum { · 170 unmodified lines
171	DEVCONF_USE_OPTIMISTIC,	171	DEVCONF_USE_OPTIMISTIC,
172	DEVCONF_ACCEPT_RA_MTU,	172	DEVCONF_ACCEPT_RA_MTU,
173	DEVCONF_STABLE_SECRET,	173	DEVCONF_STABLE_SECRET,
		174	DEVCONF_USE_OIF_ADDRS_ONLY,
174	DEVCONF_MAX	175	DEVCONF_MAX
175	};	176	};
176		177

net/ipv6/addrconf.c+19−3

 	.accept_ra_mtu		= 1,
 	.stable_secret		= {
 		.initialized = false,
-	}
+	},
+	.use_oif_addrs_only	= 0,
 };
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.stable_secret		= {
 		.initialized = false,
 	},
+	.use_oif_addrs_only	= 0,
 };
 /* Check if a valid qdisc is available */
 	 *    include addresses assigned to interfaces
 	 *    belonging to the same site as the outgoing
 	 *    interface.)
+	 *  - "It is RECOMMENDED that the candidate source addresses
+	 *    be the set of unicast addresses assigned to the
+	 *    interface that will be used to send to the destination
+	 *    (the 'outgoing' interface)." (RFC 6724)
 	 */
 	if (dst_dev) {
+		idev = __in6_dev_get(dst_dev);
 		if ((dst_type & IPV6_ADDR_MULTICAST) ||
-		    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) {
+		    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
-			idev = __in6_dev_get(dst_dev);
+		    (idev && idev->cnf.use_oif_addrs_only)) {
 			use_oif_addr = true;
 		}
 	}
 	array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
 	array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
 	/* we omit DEVCONF_STABLE_SECRET for now */
+	array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
 }
 static inline size_t inet6_ifla6_size(void)
 			.mode		= 0600,
 			.proc_handler	= addrconf_sysctl_stable_secret,
 		},
+		{
+			.procname       = "use_oif_addrs_only",
+			.data           = &ipv6_devconf.use_oif_addrs_only,
+			.maxlen         = sizeof(int),
+			.mode           = 0644,
+			.proc_handler   = proc_dointvec,
+		},
 		{
 			/* sentinel */
 		}