Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d860b2e8 authored by Joel Scherpelz's avatar Joel Scherpelz
Browse files

FROMLIST: net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs 



This commit adds a new sysctl accept_ra_rt_info_min_plen that
defines the minimum acceptable prefix length of Route Information
Options. The new sysctl is intended to be used together with
accept_ra_rt_info_max_plen to configure a range of acceptable
prefix lengths. It is useful to prevent misconfigurations from
unintentionally blackholing too much of the IPv6 address space
(e.g., home routers announcing RIOs for fc00::/7, which is
incorrect).

[backport of net-next bbea124bc99df968011e76eba105fe964a4eceab]
Bug: 33333670
Test: net_test passes

Signed-off-by: default avatarJoel Scherpelz <jscherpelz@google.com>
Acked-by: default avatarLorenzo Colitti <lorenzo@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2cedf8b9

Documentation/networking/ip-sysctl.txt

+11 −2
Original line number Diff line number Diff line
@@ -1452,11 +1452,20 @@ accept_ra_pinfo - BOOLEAN 
	Functional default: enabled if accept_ra is enabled.

			    disabled if accept_ra is disabled.



accept_ra_rt_info_min_plen - INTEGER

	Minimum prefix length of Route Information in RA.



	Route Information w/ prefix smaller than this variable shall

	be ignored.



	Functional default: 0 if accept_ra_rtr_pref is enabled.

			    -1 if accept_ra_rtr_pref is disabled.



accept_ra_rt_info_max_plen - INTEGER

	Maximum prefix length of Route Information in RA.



	Route Information w/ prefix larger than or equal to this

	variable shall be ignored.

	Route Information w/ prefix larger than this variable shall

	be ignored.



	Functional default: 0 if accept_ra_rtr_pref is enabled.

			    -1 if accept_ra_rtr_pref is disabled.

include/linux/ipv6.h

+1 −0
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ struct ipv6_devconf { 
	__s32		accept_ra_rtr_pref;

	__s32		rtr_probe_interval;

#ifdef CONFIG_IPV6_ROUTE_INFO

	__s32		accept_ra_rt_info_min_plen;

	__s32		accept_ra_rt_info_max_plen;

#endif

#endif

include/uapi/linux/ipv6.h

+6 −0
Original line number Diff line number Diff line
@@ -179,6 +179,12 @@ enum { 
	DEVCONF_DROP_UNSOLICITED_NA,

	DEVCONF_KEEP_ADDR_ON_DOWN,

	DEVCONF_RTR_SOLICIT_MAX_INTERVAL,

	DEVCONF_SEG6_ENABLED,

	DEVCONF_SEG6_REQUIRE_HMAC,

	DEVCONF_ENHANCED_DAD,

	DEVCONF_ADDR_GEN_MODE,

	DEVCONF_DISABLE_POLICY,

	DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,

	DEVCONF_MAX

};

include/uapi/linux/sysctl.h

+1 −0
Original line number Diff line number Diff line
@@ -568,6 +568,7 @@ enum { 
	NET_IPV6_PROXY_NDP=23,

	NET_IPV6_ACCEPT_SOURCE_ROUTE=25,

	NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,

	NET_IPV6_ACCEPT_RA_RT_INFO_MIN_PLEN=27,

	__NET_IPV6_MAX

};

net/ipv6/addrconf.c

+10 −0
Original line number Diff line number Diff line
@@ -223,6 +223,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { 
	.accept_ra_rtr_pref	= 1,

	.rtr_probe_interval	= 60 * HZ,

#ifdef CONFIG_IPV6_ROUTE_INFO

	.accept_ra_rt_info_min_plen = 0,

	.accept_ra_rt_info_max_plen = 0,

#endif

#endif
@@ -270,6 +271,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { 
	.accept_ra_rtr_pref	= 1,

	.rtr_probe_interval	= 60 * HZ,

#ifdef CONFIG_IPV6_ROUTE_INFO

	.accept_ra_rt_info_min_plen = 0,

	.accept_ra_rt_info_max_plen = 0,

#endif

#endif
@@ -4952,6 +4954,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, 
	array[DEVCONF_RTR_PROBE_INTERVAL] =

		jiffies_to_msecs(cnf->rtr_probe_interval);

#ifdef CONFIG_IPV6_ROUTE_INFO

	array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;

	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;

#endif

#endif
@@ -5927,6 +5930,13 @@ static const struct ctl_table addrconf_sysctl[] = { 
		.proc_handler	= proc_dointvec_jiffies,

	},

#ifdef CONFIG_IPV6_ROUTE_INFO

	{

		.procname	= "accept_ra_rt_info_min_plen",

		.data		= &ipv6_devconf.accept_ra_rt_info_min_plen,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

	},

	{

		.procname	= "accept_ra_rt_info_max_plen",

		.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,