net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.
This commit adds a new sysctl accept_ra_rt_info_min_plen that defines the minimum acceptable prefix length of Route Information Options. The new sysctl is intended to be used together with accept_ra_rt_info_max_plen to configure a range of acceptable prefix lengths. It is useful to prevent misconfigurations from unintentionally blackholing too much of the IPv6 address space (e.g., home routers announcing RIOs for fc00::/7, which is incorrect). [backport of net-next bbea124bc99df968011e76eba105fe964a4eceab] Bug: 33333670 Test: net_test passes Change-Id: I5be36ef0e71b4fa9083d7aad2cbb00dd281d778f Signed-off-by: Joel Scherpelz <jscherpelz@google.com> Acked-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Git-commit: 161e88ebebc748d1fa51055fc31be6c98db3316e Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
This commit is contained in:
parent
f5d1bea22e
commit
18c0b520fe
|
@ -1167,11 +1167,20 @@ accept_ra_pinfo - BOOLEAN
|
|||
Functional default: enabled if accept_ra is enabled.
|
||||
disabled if accept_ra is disabled.
|
||||
|
||||
accept_ra_rt_info_min_plen - INTEGER
|
||||
Minimum prefix length of Route Information in RA.
|
||||
|
||||
Route Information w/ prefix smaller than this variable shall
|
||||
be ignored.
|
||||
|
||||
Functional default: 0 if accept_ra_rtr_pref is enabled.
|
||||
-1 if accept_ra_rtr_pref is disabled.
|
||||
|
||||
accept_ra_rt_info_max_plen - INTEGER
|
||||
Maximum prefix length of Route Information in RA.
|
||||
|
||||
Route Information w/ prefix larger than or equal to this
|
||||
variable shall be ignored.
|
||||
Route Information w/ prefix larger than this variable shall
|
||||
be ignored.
|
||||
|
||||
Functional default: 0 if accept_ra_rtr_pref is enabled.
|
||||
-1 if accept_ra_rtr_pref is disabled.
|
||||
|
|
|
@ -33,6 +33,7 @@ struct ipv6_devconf {
|
|||
__s32 accept_ra_rtr_pref;
|
||||
__s32 rtr_probe_interval;
|
||||
#ifdef CONFIG_IPV6_ROUTE_INFO
|
||||
__s32 accept_ra_rt_info_min_plen;
|
||||
__s32 accept_ra_rt_info_max_plen;
|
||||
#endif
|
||||
#endif
|
||||
|
|
|
@ -165,6 +165,18 @@ enum {
|
|||
DEVCONF_ACCEPT_RA_MTU,
|
||||
DEVCONF_USE_OIF_ADDRS_ONLY,
|
||||
DEVCONF_USE_OPTIMISTIC,
|
||||
DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
|
||||
DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,
|
||||
DEVCONF_DROP_UNICAST_IN_L2_MULTICAST,
|
||||
DEVCONF_DROP_UNSOLICITED_NA,
|
||||
DEVCONF_KEEP_ADDR_ON_DOWN,
|
||||
DEVCONF_RTR_SOLICIT_MAX_INTERVAL,
|
||||
DEVCONF_SEG6_ENABLED,
|
||||
DEVCONF_SEG6_REQUIRE_HMAC,
|
||||
DEVCONF_ENHANCED_DAD,
|
||||
DEVCONF_ADDR_GEN_MODE,
|
||||
DEVCONF_DISABLE_POLICY,
|
||||
DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
|
||||
DEVCONF_MAX
|
||||
};
|
||||
|
||||
|
|
|
@ -569,6 +569,8 @@ enum {
|
|||
NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
|
||||
NET_IPV6_PROXY_NDP=23,
|
||||
NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
|
||||
NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,
|
||||
NET_IPV6_ACCEPT_RA_RT_INFO_MIN_PLEN=27,
|
||||
__NET_IPV6_MAX
|
||||
};
|
||||
|
||||
|
|
|
@ -199,6 +199,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
|
|||
.accept_ra_rtr_pref = 1,
|
||||
.rtr_probe_interval = 60 * HZ,
|
||||
#ifdef CONFIG_IPV6_ROUTE_INFO
|
||||
.accept_ra_rt_info_min_plen = 0,
|
||||
.accept_ra_rt_info_max_plen = 0,
|
||||
#endif
|
||||
#endif
|
||||
|
@ -237,6 +238,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
|
|||
.accept_ra_rtr_pref = 1,
|
||||
.rtr_probe_interval = 60 * HZ,
|
||||
#ifdef CONFIG_IPV6_ROUTE_INFO
|
||||
.accept_ra_rt_info_min_plen = 0,
|
||||
.accept_ra_rt_info_max_plen = 0,
|
||||
#endif
|
||||
#endif
|
||||
|
@ -4375,6 +4377,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
|
|||
array[DEVCONF_RTR_PROBE_INTERVAL] =
|
||||
jiffies_to_msecs(cnf->rtr_probe_interval);
|
||||
#ifdef CONFIG_IPV6_ROUTE_INFO
|
||||
array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
|
||||
array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
|
||||
#endif
|
||||
#endif
|
||||
|
@ -5100,6 +5103,13 @@ static struct addrconf_sysctl_table
|
|||
.proc_handler = proc_dointvec_jiffies,
|
||||
},
|
||||
#ifdef CONFIG_IPV6_ROUTE_INFO
|
||||
{
|
||||
.procname = "accept_ra_rt_info_min_plen",
|
||||
.data = &ipv6_devconf.accept_ra_rt_info_min_plen,
|
||||
.maxlen = sizeof(int),
|
||||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
{
|
||||
.procname = "accept_ra_rt_info_max_plen",
|
||||
.data = &ipv6_devconf.accept_ra_rt_info_max_plen,
|
||||
|
|
|
@ -1286,6 +1286,8 @@ skip_linkparms:
|
|||
ri->prefix_len == 0)
|
||||
continue;
|
||||
#endif
|
||||
if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
|
||||
continue;
|
||||
if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
|
||||
continue;
|
||||
rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
|
||||
|
|
Loading…
Reference in New Issue