History

net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.

This commit adds a new sysctl accept_ra_rt_info_min_plen that defines the minimum acceptable prefix length of Route Information Options. The new sysctl is intended to be used together with accept_ra_rt_info_max_plen to configure a range of acceptable prefix lengths. It is useful to prevent misconfigurations from unintentionally blackholing too much of the IPv6 address space (e.g., home routers announcing RIOs for fc00::/7, which is incorrect).

Joel Scherpelz committed 9 years ago

Commit bbea1241 parent 0e4c9f16 files · +26 −2Browse files

Unified · Split

6 files
  1. Documentation/networking/ip-sysctl.txt +11 −2
  2. include/linux/ipv6.h +1 −0
  3. include/uapi/linux/ipv6.h +1 −0
  4. include/uapi/linux/sysctl.h +1 −0
  5. net/ipv6/addrconf.c +10 −0
  6. net/ipv6/ndisc.c +2 −0
Documentation/networking/ip-sysctl.txt+11−2
@@ -1461,11 +1461,20 @@ accept_ra_pinfo - BOOLEAN · 1460 unmodified lines
1461 Functional default: enabled if accept_ra is enabled.1461 Functional default: enabled if accept_ra is enabled.
1462 disabled if accept_ra is disabled.1462 disabled if accept_ra is disabled.
1463 1463
1464accept_ra_rt_info_min_plen - INTEGER
1465 Minimum prefix length of Route Information in RA.
1466
1467 Route Information w/ prefix smaller than this variable shall
1468 be ignored.
1469
1470 Functional default: 0 if accept_ra_rtr_pref is enabled.
1471 -1 if accept_ra_rtr_pref is disabled.
1472
1464accept_ra_rt_info_max_plen - INTEGER1473accept_ra_rt_info_max_plen - INTEGER
1465 Maximum prefix length of Route Information in RA.1474 Maximum prefix length of Route Information in RA.
1466 1475
1467 Route Information w/ prefix larger than or equal to this1476 Route Information w/ prefix larger than this variable shall
1468 variable shall be ignored.1477 be ignored.
1469 1478
1470 Functional default: 0 if accept_ra_rtr_pref is enabled.1479 Functional default: 0 if accept_ra_rtr_pref is enabled.
1471 -1 if accept_ra_rtr_pref is disabled.1480 -1 if accept_ra_rtr_pref is disabled.
include/linux/ipv6.h+1−0
@@ -37,6 +37,7 @@ struct ipv6_devconf { · 36 unmodified lines
37 __s32 accept_ra_rtr_pref;37 __s32 accept_ra_rtr_pref;
38 __s32 rtr_probe_interval;38 __s32 rtr_probe_interval;
39#ifdef CONFIG_IPV6_ROUTE_INFO39#ifdef CONFIG_IPV6_ROUTE_INFO
40 __s32 accept_ra_rt_info_min_plen;
40 __s32 accept_ra_rt_info_max_plen;41 __s32 accept_ra_rt_info_max_plen;
41#endif42#endif
42#endif43#endif
include/uapi/linux/ipv6.h+1−0
@@ -184,6 +184,7 @@ enum { · 183 unmodified lines
184 DEVCONF_ENHANCED_DAD,184 DEVCONF_ENHANCED_DAD,
185 DEVCONF_ADDR_GEN_MODE,185 DEVCONF_ADDR_GEN_MODE,
186 DEVCONF_DISABLE_POLICY,186 DEVCONF_DISABLE_POLICY,
187 DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
187 DEVCONF_MAX188 DEVCONF_MAX
188};189};
189 190
include/uapi/linux/sysctl.h+1−0
@@ -568,6 +568,7 @@ enum { · 567 unmodified lines
568 NET_IPV6_PROXY_NDP=23,568 NET_IPV6_PROXY_NDP=23,
569 NET_IPV6_ACCEPT_SOURCE_ROUTE=25,569 NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
570 NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,570 NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,
571 NET_IPV6_ACCEPT_RA_RT_INFO_MIN_PLEN=27,
571 __NET_IPV6_MAX572 __NET_IPV6_MAX
572};573};
573 574
net/ipv6/addrconf.c+10−0
@@ -224,6 +224,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { · 223 unmodified lines
224 .accept_ra_rtr_pref = 1,224 .accept_ra_rtr_pref = 1,
225 .rtr_probe_interval = 60 * HZ,225 .rtr_probe_interval = 60 * HZ,
226#ifdef CONFIG_IPV6_ROUTE_INFO226#ifdef CONFIG_IPV6_ROUTE_INFO
227 .accept_ra_rt_info_min_plen = 0,
227 .accept_ra_rt_info_max_plen = 0,228 .accept_ra_rt_info_max_plen = 0,
228#endif229#endif
229#endif230#endif
@@ -277,6 +278,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { · 47 unmodified lines
277 .accept_ra_rtr_pref = 1,278 .accept_ra_rtr_pref = 1,
278 .rtr_probe_interval = 60 * HZ,279 .rtr_probe_interval = 60 * HZ,
279#ifdef CONFIG_IPV6_ROUTE_INFO280#ifdef CONFIG_IPV6_ROUTE_INFO
281 .accept_ra_rt_info_min_plen = 0,
280 .accept_ra_rt_info_max_plen = 0,282 .accept_ra_rt_info_max_plen = 0,
281#endif283#endif
282#endif284#endif
@@ -4979,6 +4981,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, · 4696 unmodified lines
4979 array[DEVCONF_RTR_PROBE_INTERVAL] =4981 array[DEVCONF_RTR_PROBE_INTERVAL] =
4980 jiffies_to_msecs(cnf->rtr_probe_interval);4982 jiffies_to_msecs(cnf->rtr_probe_interval);
4981#ifdef CONFIG_IPV6_ROUTE_INFO4983#ifdef CONFIG_IPV6_ROUTE_INFO
4984 array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
4982 array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;4985 array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
4983#endif4986#endif
4984#endif4987#endif
@@ -6121,6 +6124,13 @@ static const struct ctl_table addrconf_sysctl[] = { · 1136 unmodified lines
6121 .proc_handler = proc_dointvec_jiffies,6124 .proc_handler = proc_dointvec_jiffies,
6122 },6125 },
6123#ifdef CONFIG_IPV6_ROUTE_INFO6126#ifdef CONFIG_IPV6_ROUTE_INFO
6127 {
6128 .procname = "accept_ra_rt_info_min_plen",
6129 .data = &ipv6_devconf.accept_ra_rt_info_min_plen,
6130 .maxlen = sizeof(int),
6131 .mode = 0644,
6132 .proc_handler = proc_dointvec,
6133 },
6124 {6134 {
6125 .procname = "accept_ra_rt_info_max_plen",6135 .procname = "accept_ra_rt_info_max_plen",
6126 .data = &ipv6_devconf.accept_ra_rt_info_max_plen,6136 .data = &ipv6_devconf.accept_ra_rt_info_max_plen,
net/ipv6/ndisc.c+2−0
@@ -1418,6 +1418,8 @@ skip_linkparms: · 1417 unmodified lines
1418 if (ri->prefix_len == 0 &&1418 if (ri->prefix_len == 0 &&
1419 !in6_dev->cnf.accept_ra_defrtr)1419 !in6_dev->cnf.accept_ra_defrtr)
1420 continue;1420 continue;
1421 if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1422 continue;
1421 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)1423 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1422 continue;1424 continue;
1423 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,1425 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,