ipv6: sysctl to restrict candidate source addresses
Per RFC 6724, section 4, "Candidate Source Addresses": It is RECOMMENDED that the candidate source addresses be the set of unicast addresses assigned to the interface that will be used to send to the destination (the "outgoing" interface). Add a sysctl to enable this behaviour. Signed-off-by: Erik Kline <ek@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> [Simplified back-port of net-next 3985e8a3611a93bb36789f65db862e5700aab65e] Bug: 19470192 Bug: 21832279 Bug: 22464419 Change-Id: Ib74ef945dcabe64215064f15ee1660b6524d65ce Conflicts: include/linux/ipv6.h include/uapi/linux/ipv6.h net/ipv6/addrconf.c
This commit is contained in:
parent
856690aa48
commit
44fd0373d8
|
@ -1281,6 +1281,13 @@ router_solicitations - INTEGER
|
|||
routers are present.
|
||||
Default: 3
|
||||
|
||||
use_oif_addrs_only - BOOLEAN
|
||||
When enabled, the candidate source addresses for destinations
|
||||
routed via this interface are restricted to the set of addresses
|
||||
configured on this interface (vis. RFC 6724, section 4).
|
||||
|
||||
Default: false
|
||||
|
||||
use_tempaddr - INTEGER
|
||||
Preference for Privacy Extensions (RFC3041).
|
||||
<= 0 : disable Privacy Extensions
|
||||
|
|
|
@ -51,6 +51,7 @@ struct ipv6_devconf {
|
|||
__s32 ndisc_notify;
|
||||
__s32 accept_ra_prefix_route;
|
||||
__s32 accept_ra_mtu;
|
||||
__s32 use_oif_addrs_only;
|
||||
void *sysctl;
|
||||
};
|
||||
|
||||
|
|
|
@ -163,6 +163,7 @@ enum {
|
|||
DEVCONF_ACCEPT_RA_PREFIX_ROUTE,
|
||||
DEVCONF_ACCEPT_RA_RT_TABLE,
|
||||
DEVCONF_ACCEPT_RA_MTU,
|
||||
DEVCONF_USE_OIF_ADDRS_ONLY,
|
||||
DEVCONF_MAX
|
||||
};
|
||||
|
||||
|
|
|
@ -207,6 +207,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
|
|||
.accept_dad = 1,
|
||||
.accept_ra_prefix_route = 1,
|
||||
.accept_ra_mtu = 1,
|
||||
.use_oif_addrs_only = 0,
|
||||
};
|
||||
|
||||
static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
|
||||
|
@ -244,6 +245,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
|
|||
.accept_dad = 1,
|
||||
.accept_ra_prefix_route = 1,
|
||||
.accept_ra_mtu = 1,
|
||||
.use_oif_addrs_only = 0,
|
||||
};
|
||||
|
||||
/* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
|
||||
|
@ -1366,9 +1368,15 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
|
|||
* include addresses assigned to interfaces
|
||||
* belonging to the same site as the outgoing
|
||||
* interface.)
|
||||
* - "It is RECOMMENDED that the candidate source addresses
|
||||
* be the set of unicast addresses assigned to the
|
||||
* interface that will be used to send to the destination
|
||||
* (the 'outgoing' interface)." (RFC 6724)
|
||||
*/
|
||||
idev = dst_dev ? __in6_dev_get(dst_dev) : NULL;
|
||||
if (((dst_type & IPV6_ADDR_MULTICAST) ||
|
||||
dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
|
||||
dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
|
||||
(idev && idev->cnf.use_oif_addrs_only)) &&
|
||||
dst.ifindex && dev->ifindex != dst.ifindex)
|
||||
continue;
|
||||
|
||||
|
@ -4262,6 +4270,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
|
|||
array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
|
||||
array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
|
||||
array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
|
||||
array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
|
||||
}
|
||||
|
||||
static inline size_t inet6_ifla6_size(void)
|
||||
|
@ -5040,6 +5049,14 @@ static struct addrconf_sysctl_table
|
|||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
{
|
||||
.procname = "use_oif_addrs_only",
|
||||
.data = &ipv6_devconf.use_oif_addrs_only,
|
||||
.maxlen = sizeof(int),
|
||||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec,
|
||||
|
||||
},
|
||||
{
|
||||
/* sentinel */
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue