net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.

This commit adds a new sysctl accept_ra_rt_info_min_plen that
defines the minimum acceptable prefix length of Route Information
Options. The new sysctl is intended to be used together with
accept_ra_rt_info_max_plen to configure a range of acceptable
prefix lengths. It is useful to prevent misconfigurations from
unintentionally blackholing too much of the IPv6 address space
(e.g., home routers announcing RIOs for fc00::/7, which is
incorrect).

[backport of net-next bbea124bc99df968011e76eba105fe964a4eceab]
Bug: 33333670
Test: net_test passes

Signed-off-by: Joel Scherpelz <jscherpelz@google.com>
Acked-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 2042261408b9616712b56e0ed3db642b8221975f..5f1ea84ed72b18a35b662c89f8559ceba55041a6 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1413,11 +1413,20 @@ accept_ra_pinfo - BOOLEAN
        Functional default: enabled if accept_ra is enabled.
                            disabled if accept_ra is disabled.
 
+accept_ra_rt_info_min_plen - INTEGER
+       Minimum prefix length of Route Information in RA.
+
+       Route Information w/ prefix smaller than this variable shall
+       be ignored.
+
+       Functional default: 0 if accept_ra_rtr_pref is enabled.
+                           -1 if accept_ra_rtr_pref is disabled.
+
 accept_ra_rt_info_max_plen - INTEGER
        Maximum prefix length of Route Information in RA.
 
-       Route Information w/ prefix larger than or equal to this
-       variable shall be ignored.
+       Route Information w/ prefix larger than this variable shall
+       be ignored.
 
        Functional default: 0 if accept_ra_rtr_pref is enabled.
                            -1 if accept_ra_rtr_pref is disabled.

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index ce777260e9ea73f2d18dd538ef6bf57ee08e063b..1182f0e21697ff64f93d0d113b42734a5bda7aaa 100644 (file)
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -36,6 +36,7 @@ struct ipv6_devconf {
        __s32           accept_ra_rtr_pref;
        __s32           rtr_probe_interval;
 #ifdef CONFIG_IPV6_ROUTE_INFO
+       __s32           accept_ra_rt_info_min_plen;
        __s32           accept_ra_rt_info_max_plen;
 #endif
 #endif

diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 2b1533859749077a09f5e50566a8ffa33156bc39..c462f1dc175e0bb0e7b7d2fbc04a29b8bb6d1e0b 100644 (file)
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -175,6 +175,16 @@ enum {
        DEVCONF_USE_OIF_ADDRS_ONLY,
        DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
        DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,
+       DEVCONF_DROP_UNICAST_IN_L2_MULTICAST,
+       DEVCONF_DROP_UNSOLICITED_NA,
+       DEVCONF_KEEP_ADDR_ON_DOWN,
+       DEVCONF_RTR_SOLICIT_MAX_INTERVAL,
+       DEVCONF_SEG6_ENABLED,
+       DEVCONF_SEG6_REQUIRE_HMAC,
+       DEVCONF_ENHANCED_DAD,
+       DEVCONF_ADDR_GEN_MODE,
+       DEVCONF_DISABLE_POLICY,
+       DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
        DEVCONF_MAX
 };
 

diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
index 0956373b56db7825c965fa18084bfedb3f21df3c..d18980e74534460a74ffe5269a5535f35756f64f 100644 (file)
--- a/include/uapi/linux/sysctl.h
+++ b/include/uapi/linux/sysctl.h
@@ -570,6 +570,7 @@ enum {
        NET_IPV6_PROXY_NDP=23,
        NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
        NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,
+       NET_IPV6_ACCEPT_RA_RT_INFO_MIN_PLEN=27,
        __NET_IPV6_MAX
 };
 

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 498a664b8dc9d988a3acfe215240b770dad8aaa7..860ffbe778cffd12dffa1035f924908cc645dbc5 100644 (file)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -202,6 +202,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
        .accept_ra_rtr_pref     = 1,
        .rtr_probe_interval     = 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+       .accept_ra_rt_info_min_plen = 0,
        .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -247,6 +248,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
        .accept_ra_rtr_pref     = 1,
        .rtr_probe_interval     = 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+       .accept_ra_rt_info_min_plen = 0,
        .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -4689,6 +4691,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_RTR_PROBE_INTERVAL] =
                jiffies_to_msecs(cnf->rtr_probe_interval);
 #ifdef CONFIG_IPV6_ROUTE_INFO
+       array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
        array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
 #endif
@@ -5648,6 +5651,13 @@ static struct addrconf_sysctl_table
                        .proc_handler   = proc_dointvec_jiffies,
                },
 #ifdef CONFIG_IPV6_ROUTE_INFO
+               {
+                       .procname       = "accept_ra_rt_info_min_plen",
+                       .data           = &ipv6_devconf.accept_ra_rt_info_min_plen,
+                       .maxlen         = sizeof(int),
+                       .mode           = 0644,
+                       .proc_handler   = proc_dointvec,
+               },
                {
                        .procname       = "accept_ra_rt_info_max_plen",
                        .data           = &ipv6_devconf.accept_ra_rt_info_max_plen,

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 84afb9a7727848038b51ee7a60eebb28d555f693..3452f9037ad4622299e653334c470be3e922e37b 100644 (file)
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1358,6 +1358,8 @@ skip_linkparms:
                        if (ri->prefix_len == 0 &&
                            !in6_dev->cnf.accept_ra_defrtr)
                                continue;
+                       if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
+                               continue;
                        if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
                                continue;
                        rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,