mirros/rockchip-kernel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipv6: sysctl to restrict candidate source addresses

Browse Source 
Per RFC 6724, section 4, "Candidate Source Addresses":

    It is RECOMMENDED that the candidate source addresses be the set
    of unicast addresses assigned to the interface that will be used
    to send to the destination (the "outgoing" interface).

Add a sysctl to enable this behaviour.

Signed-off-by: Erik Kline <ek@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[Simplified back-port of net-next 3985e8a361]

Bug: 19470192
Bug: 21832279
Bug: 22464419
Change-Id: Ib74ef945dcabe64215064f15ee1660b6524d65ce
(cherry picked from commit 0633924e77)
This commit is contained in:
Erik Kline
2015-07-22 16:38:25 +09:00
committed by Huang, Tao
parent 69923ebd71
commit 4375ac61a0
4 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Documentation/networking/ip-sysctl.txt
View File

@@ -1258,6 +1258,13 @@ router_solicitations - INTEGER
routers are present.
Default: 3
use_oif_addrs_only - BOOLEAN
When enabled, the candidate source addresses for destinations
routed via this interface are restricted to the set of addresses
configured on this interface (vis. RFC 6724, section 4).
Default: false
use_tempaddr - INTEGER
Preference for Privacy Extensions (RFC3041).
<= 0 : disable Privacy Extensions

1
include/linux/ipv6.h
View File

@@ -50,6 +50,7 @@ struct ipv6_devconf {
__s32 accept_dad;
__s32 force_tllao;
__s32 ndisc_notify;
__s32 use_oif_addrs_only;
void *sysctl;
};

1
include/uapi/linux/ipv6.h
View File

@@ -162,6 +162,7 @@ enum {
DEVCONF_NDISC_NOTIFY,
DEVCONF_ACCEPT_RA_RT_TABLE,
DEVCONF_USE_OPTIMISTIC,
DEVCONF_USE_OIF_ADDRS_ONLY,
DEVCONF_MAX
};

19
net/ipv6/addrconf.c
View File

@@ -203,6 +203,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
.accept_source_route = 0, /* we do not accept RH0 by default. */
.disable_ipv6 = 0,
.accept_dad = 1,
.use_oif_addrs_only = 0,
};
static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -238,6 +239,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
.accept_source_route = 0, /* we do not accept RH0 by default. */
.disable_ipv6 = 0,
.accept_dad = 1,
.use_oif_addrs_only = 0,
};
/* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -1386,9 +1388,15 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
* include addresses assigned to interfaces
* belonging to the same site as the outgoing
* interface.)
* - "It is RECOMMENDED that the candidate source addresses
* be the set of unicast addresses assigned to the
* interface that will be used to send to the destination
* (the 'outgoing' interface)." (RFC 6724)
*/
idev = dst_dev ? __in6_dev_get(dst_dev) : NULL;
if (((dst_type & IPV6_ADDR_MULTICAST) ||
dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
(idev && idev->cnf.use_oif_addrs_only)) &&
dst.ifindex && dev->ifindex != dst.ifindex)
continue;
@@ -4284,6 +4292,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
}
static inline size_t inet6_ifla6_size(void)
@@ -5056,6 +5065,14 @@ static struct addrconf_sysctl_table
.mode = 0644,
.proc_handler = proc_dointvec
},
{
.procname = "use_oif_addrs_only",
.data = &ipv6_devconf.use_oif_addrs_only,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{
/* sentinel */
}