Commit bb6853dd authored by Hangbin Liu's avatar Hangbin Liu Committed by Kamal Mostafa

net/ipv6: add sysctl option accept_ra_min_hop_limit

[ Upstream commit 8013d1d7 ]

Commit 6fd99094 ("ipv6: Don't reduce hop limit for an interface")
disabled accept hop limit from RA if it is smaller than the current hop
limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4.  Processing Received Router Advertisements
   A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time,
   and Retrans Timer) may contain a value denoting that it is
   unspecified.  In such cases, the parameter should be ignored and the
   host should continue using whatever value it is already using.

   If the received Cur Hop Limit value is non-zero, the host SHOULD set
   its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum
hop limit value they can accept from RA. And set default to 1 to meet RFC
standards.
Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
Acked-by: default avatarYOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
parent ec77e463
...@@ -1266,6 +1266,14 @@ accept_ra_from_local - BOOLEAN ...@@ -1266,6 +1266,14 @@ accept_ra_from_local - BOOLEAN
disabled if accept_ra_from_local is disabled disabled if accept_ra_from_local is disabled
on a specific interface. on a specific interface.
accept_ra_min_hop_limit - INTEGER
Minimum hop limit Information in Router Advertisement.
Hop limit Information in Router Advertisement less than this
variable shall be ignored.
Default: 1
accept_ra_pinfo - BOOLEAN accept_ra_pinfo - BOOLEAN
Learn Prefix Information in Router Advertisement. Learn Prefix Information in Router Advertisement.
......
...@@ -29,6 +29,7 @@ struct ipv6_devconf { ...@@ -29,6 +29,7 @@ struct ipv6_devconf {
__s32 max_desync_factor; __s32 max_desync_factor;
__s32 max_addresses; __s32 max_addresses;
__s32 accept_ra_defrtr; __s32 accept_ra_defrtr;
__s32 accept_ra_min_hop_limit;
__s32 accept_ra_pinfo; __s32 accept_ra_pinfo;
#ifdef CONFIG_IPV6_ROUTER_PREF #ifdef CONFIG_IPV6_ROUTER_PREF
__s32 accept_ra_rtr_pref; __s32 accept_ra_rtr_pref;
......
...@@ -165,6 +165,8 @@ enum { ...@@ -165,6 +165,8 @@ enum {
DEVCONF_SUPPRESS_FRAG_NDISC, DEVCONF_SUPPRESS_FRAG_NDISC,
DEVCONF_ACCEPT_RA_FROM_LOCAL, DEVCONF_ACCEPT_RA_FROM_LOCAL,
DEVCONF_USE_OPTIMISTIC, DEVCONF_USE_OPTIMISTIC,
DEVCONF_USE_OIF_ADDRS_ONLY,
DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
DEVCONF_MAX DEVCONF_MAX
}; };
......
...@@ -188,6 +188,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { ...@@ -188,6 +188,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
.max_addresses = IPV6_MAX_ADDRESSES, .max_addresses = IPV6_MAX_ADDRESSES,
.accept_ra_defrtr = 1, .accept_ra_defrtr = 1,
.accept_ra_from_local = 0, .accept_ra_from_local = 0,
.accept_ra_min_hop_limit= 1,
.accept_ra_pinfo = 1, .accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF #ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1, .accept_ra_rtr_pref = 1,
...@@ -225,6 +226,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { ...@@ -225,6 +226,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
.max_addresses = IPV6_MAX_ADDRESSES, .max_addresses = IPV6_MAX_ADDRESSES,
.accept_ra_defrtr = 1, .accept_ra_defrtr = 1,
.accept_ra_from_local = 0, .accept_ra_from_local = 0,
.accept_ra_min_hop_limit= 1,
.accept_ra_pinfo = 1, .accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF #ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1, .accept_ra_rtr_pref = 1,
...@@ -4353,6 +4355,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, ...@@ -4353,6 +4355,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor; array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses; array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr; array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo; array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
#ifdef CONFIG_IPV6_ROUTER_PREF #ifdef CONFIG_IPV6_ROUTER_PREF
array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref; array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
...@@ -5169,6 +5172,13 @@ static struct addrconf_sysctl_table ...@@ -5169,6 +5172,13 @@ static struct addrconf_sysctl_table
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec, .proc_handler = proc_dointvec,
}, },
{
.procname = "accept_ra_min_hop_limit",
.data = &ipv6_devconf.accept_ra_min_hop_limit,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{ {
.procname = "accept_ra_pinfo", .procname = "accept_ra_pinfo",
.data = &ipv6_devconf.accept_ra_pinfo, .data = &ipv6_devconf.accept_ra_pinfo,
......
...@@ -1215,18 +1215,16 @@ static void ndisc_router_discovery(struct sk_buff *skb) ...@@ -1215,18 +1215,16 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (rt) if (rt)
rt6_set_expires(rt, jiffies + (HZ * lifetime)); rt6_set_expires(rt, jiffies + (HZ * lifetime));
if (ra_msg->icmph.icmp6_hop_limit) { if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
/* Only set hop_limit on the interface if it is higher than ra_msg->icmph.icmp6_hop_limit) {
* the current hop_limit. if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
*/
if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
if (rt)
dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
ra_msg->icmph.icmp6_hop_limit);
} else { } else {
ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n"); ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
} }
if (rt)
dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
ra_msg->icmph.icmp6_hop_limit);
} }
skip_defrtr: skip_defrtr:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment