History

net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.

This commit adds a new sysctl accept_ra_rt_info_min_plen that defines the minimum acceptable prefix length of Route Information Options. The new sysctl is intended to be used together with accept_ra_rt_info_max_plen to configure a range of acceptable prefix lengths. It is useful to prevent misconfigurations from unintentionally blackholing too much of the IPv6 address space (e.g., home routers announcing RIOs for fc00::/7, which is incorrect).

Joel Scherpelz committed 9 years ago

Commit bbea1241 parent 0e4c9f16 files · +26 −2Browse files

Unified · Split

6 files
  1. Documentation/networking/ip-sysctl.txt +11 −2
  2. include/linux/ipv6.h +1 −0
  3. include/uapi/linux/ipv6.h +1 −0
  4. include/uapi/linux/sysctl.h +1 −0
  5. net/ipv6/addrconf.c +10 −0
  6. net/ipv6/ndisc.c +2 −0
Documentation/networking/ip-sysctl.txt+11−2
@@ -1461,11 +1461,20 @@ accept_ra_pinfo - BOOLEAN · 1460 unmodified lines
14611461 Functional default: enabled if accept_ra is enabled.
14621462 disabled if accept_ra is disabled.
14631463
1464+accept_ra_rt_info_min_plen - INTEGER
1465+ Minimum prefix length of Route Information in RA.
1466+
1467+ Route Information w/ prefix smaller than this variable shall
1468+ be ignored.
1469+
1470+ Functional default: 0 if accept_ra_rtr_pref is enabled.
1471+ -1 if accept_ra_rtr_pref is disabled.
1472+
14641473 accept_ra_rt_info_max_plen - INTEGER
14651474 Maximum prefix length of Route Information in RA.
14661475
1467− Route Information w/ prefix larger than or equal to this
1468− variable shall be ignored.
1476+ Route Information w/ prefix larger than this variable shall
1477+ be ignored.
14691478
14701479 Functional default: 0 if accept_ra_rtr_pref is enabled.
14711480 -1 if accept_ra_rtr_pref is disabled.
include/linux/ipv6.h+1−0
@@ -37,6 +37,7 @@ struct ipv6_devconf { · 36 unmodified lines
3737 __s32 accept_ra_rtr_pref;
3838 __s32 rtr_probe_interval;
3939 #ifdef CONFIG_IPV6_ROUTE_INFO
40+ __s32 accept_ra_rt_info_min_plen;
4041 __s32 accept_ra_rt_info_max_plen;
4142 #endif
4243 #endif
include/uapi/linux/ipv6.h+1−0
@@ -184,6 +184,7 @@ enum { · 183 unmodified lines
184184 DEVCONF_ENHANCED_DAD,
185185 DEVCONF_ADDR_GEN_MODE,
186186 DEVCONF_DISABLE_POLICY,
187+ DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
187188 DEVCONF_MAX
188189 };
189190
include/uapi/linux/sysctl.h+1−0
@@ -568,6 +568,7 @@ enum { · 567 unmodified lines
568568 NET_IPV6_PROXY_NDP=23,
569569 NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
570570 NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,
571+ NET_IPV6_ACCEPT_RA_RT_INFO_MIN_PLEN=27,
571572 __NET_IPV6_MAX
572573 };
573574
net/ipv6/addrconf.c+10−0
@@ -224,6 +224,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { · 223 unmodified lines
224224 .accept_ra_rtr_pref = 1,
225225 .rtr_probe_interval = 60 * HZ,
226226 #ifdef CONFIG_IPV6_ROUTE_INFO
227+ .accept_ra_rt_info_min_plen = 0,
227228 .accept_ra_rt_info_max_plen = 0,
228229 #endif
229230 #endif
@@ -277,6 +278,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { · 47 unmodified lines
277278 .accept_ra_rtr_pref = 1,
278279 .rtr_probe_interval = 60 * HZ,
279280 #ifdef CONFIG_IPV6_ROUTE_INFO
281+ .accept_ra_rt_info_min_plen = 0,
280282 .accept_ra_rt_info_max_plen = 0,
281283 #endif
282284 #endif
@@ -4979,6 +4981,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, · 4696 unmodified lines
49794981 array[DEVCONF_RTR_PROBE_INTERVAL] =
49804982 jiffies_to_msecs(cnf->rtr_probe_interval);
49814983 #ifdef CONFIG_IPV6_ROUTE_INFO
4984+ array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
49824985 array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
49834986 #endif
49844987 #endif
@@ -6121,6 +6124,13 @@ static const struct ctl_table addrconf_sysctl[] = { · 1136 unmodified lines
61216124 .proc_handler = proc_dointvec_jiffies,
61226125 },
61236126 #ifdef CONFIG_IPV6_ROUTE_INFO
6127+ {
6128+ .procname = "accept_ra_rt_info_min_plen",
6129+ .data = &ipv6_devconf.accept_ra_rt_info_min_plen,
6130+ .maxlen = sizeof(int),
6131+ .mode = 0644,
6132+ .proc_handler = proc_dointvec,
6133+ },
61246134 {
61256135 .procname = "accept_ra_rt_info_max_plen",
61266136 .data = &ipv6_devconf.accept_ra_rt_info_max_plen,
net/ipv6/ndisc.c+2−0
@@ -1418,6 +1418,8 @@ skip_linkparms: · 1417 unmodified lines
14181418 if (ri->prefix_len == 0 &&
14191419 !in6_dev->cnf.accept_ra_defrtr)
14201420 continue;
1421+ if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1422+ continue;
14211423 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
14221424 continue;
14231425 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,