network: introduce IPv4AcceptLocal= setting

Closes #16090.

diff --git a/man/systemd.network.xml b/man/systemd.network.xml
index d23e8a548c1b972438dfb718bb723733639a62b7..ae93a39eb462dcb5b925dd9f281fed4763e025f3 100644 (file)
--- a/man/systemd.network.xml
+++ b/man/systemd.network.xml
@@ -672,6 +672,13 @@
           When unset, the kernel's default will be used.
         </para></listitem>
         </varlistentry>
+        <varlistentry>
+          <term><varname>IPv4AcceptLocal=</varname></term>
+          <listitem><para>Takes a boolean. Accept packets with local source addresses. In combination
+          with suitable routing, this can be used to direct packets between two local interfaces over
+          the wire and have them accepted properly. When unset, the kernel's default will be used.
+          </para></listitem>
+        </varlistentry>
         <varlistentry>
           <term><varname>IPv4ProxyARP=</varname></term>
           <listitem><para>Takes a boolean. Configures proxy ARP for IPv4. Proxy ARP is the technique in which one host,

diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index 805aff3ab1d5dd3181db9b27c8daa43c53eb7869..31ffc8b48860e79b0a835233f0ac09d57b9cfa8b 100644 (file)
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -2532,6 +2532,22 @@ static int link_set_ipv6_mtu(Link *link) {
         return 0;
 }
 
+static int link_set_ipv4_accept_local(Link *link) {
+        int r;
+
+        if (link->flags & IFF_LOOPBACK)
+                return 0;
+
+        if (link->network->ipv4_accept_local < 0)
+                return 0;
+
+        r = sysctl_write_ip_property_boolean(AF_INET, link->ifname, "accept_local", link->network->ipv4_accept_local);
+        if (r < 0)
+                log_link_warning_errno(link, r, "Cannot set IPv4 accept_local flag for interface: %m");
+
+        return 0;
+}
+
 static bool link_is_static_address_configured(Link *link, Address *address) {
         Address *net_address;
 
@@ -2871,6 +2887,10 @@ static int link_configure(Link *link) {
         if (r < 0)
                 return r;
 
+        r = link_set_ipv4_accept_local(link);
+        if (r < 0)
+                return r;
+
         r = link_set_flags(link);
         if (r < 0)
                 return r;

diff --git a/src/network/networkd-network-gperf.gperf b/src/network/networkd-network-gperf.gperf
index 39188906648f68e03cc632e6074150b0b993ed3b..5c2a4d36a11bbe6e731816f4c1bb65af1ca07cc1 100644 (file)
--- a/src/network/networkd-network-gperf.gperf
+++ b/src/network/networkd-network-gperf.gperf
@@ -96,6 +96,7 @@ Network.IPv6DuplicateAddressDetection,       config_parse_int,
 Network.IPv6HopLimit,                        config_parse_int,                                         0,                             offsetof(Network, ipv6_hop_limit)
 Network.IPv6ProxyNDP,                        config_parse_tristate,                                    0,                             offsetof(Network, ipv6_proxy_ndp)
 Network.IPv6MTUBytes,                        config_parse_mtu,                                         AF_INET6,                      offsetof(Network, ipv6_mtu)
+Network.IPv4AcceptLocal,                     config_parse_tristate,                                    0,                             offsetof(Network, ipv4_accept_local)
 Network.ActiveSlave,                         config_parse_bool,                                        0,                             offsetof(Network, active_slave)
 Network.PrimarySlave,                        config_parse_bool,                                        0,                             offsetof(Network, primary_slave)
 Network.IPv4ProxyARP,                        config_parse_tristate,                                    0,                             offsetof(Network, proxy_arp)

diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c
index 124c570b0e48ed12e83288009ad13e8020f853a0..bbecd706ce99c60e51dc3c411ad0e02f22aca391 100644 (file)
--- a/src/network/networkd-network.c
+++ b/src/network/networkd-network.c
@@ -450,6 +450,8 @@ int network_load_one(Manager *manager, OrderedHashmap **networks, const char *fi
                 /* If LinkLocalAddressing= is not set, then set to ADDRESS_FAMILY_IPV6 later. */
                 .link_local = _ADDRESS_FAMILY_INVALID,
 
+                .ipv4_accept_local = -1,
+
                 .ipv6_privacy_extensions = IPV6_PRIVACY_EXTENSIONS_NO,
                 .ipv6_accept_ra = -1,
                 .ipv6_dad_transmits = -1,

diff --git a/src/network/networkd-network.h b/src/network/networkd-network.h
index 934a33ac94357ab840de3ad8cbae0e9473657e94..590162286221609f35bbefcc52fdff3a35daa952 100644 (file)
--- a/src/network/networkd-network.h
+++ b/src/network/networkd-network.h
@@ -237,6 +237,7 @@ struct Network {
 
         AddressFamily ip_forward;
         bool ip_masquerade;
+        int ipv4_accept_local;
 
         int ipv6_accept_ra;
         int ipv6_dad_transmits;

diff --git a/test/fuzz/fuzz-network-parser/directives.network b/test/fuzz/fuzz-network-parser/directives.network
index 7cade0e9edc297132c4ff42de6da06f76d338d6a..478b574418efbc1206c8651e28f5229c7cf78afc 100644 (file)
--- a/test/fuzz/fuzz-network-parser/directives.network
+++ b/test/fuzz/fuzz-network-parser/directives.network
@@ -153,6 +153,7 @@ Address=
 IPv6ProxyNDPAddress=
 IPv6AcceptRA=
 IPv6AcceptRouterAdvertisements=
+IPv4AcceptLocal=
 DNSSECNegativeTrustAnchors=
 MACVTAP=
 IPv6PrivacyExtensions=