net/ipv6: add sysctl option accept_ra_min_hop_limit

[ Upstream commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 ]

Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface")
disabled accept hop limit from RA if it is smaller than the current hop
limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4.  Processing Received Router Advertisements
   A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time,
   and Retrans Timer) may contain a value denoting that it is
   unspecified.  In such cases, the parameter should be ignored and the
   host should continue using whatever value it is already using.

   If the received Cur Hop Limit value is non-zero, the host SHOULD set
   its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum
hop limit value they can accept from RA. And set default to 1 to meet RFC
standards.

Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: YOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 7d8dc93fe2eb25986832f26c4088c13570fd7a11..3e5b1b5466e5f0cf00f5efb549f4266ac19e82b0 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1156,6 +1156,14 @@ accept_ra_defrtr - BOOLEAN
        Functional default: enabled if accept_ra is enabled.
                            disabled if accept_ra is disabled.
 
+accept_ra_min_hop_limit - INTEGER
+       Minimum hop limit Information in Router Advertisement.
+
+       Hop limit Information in Router Advertisement less than this
+       variable shall be ignored.
+
+       Default: 1
+
 accept_ra_pinfo - BOOLEAN
        Learn Prefix Information in Router Advertisement.
 

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 88c0cf0079adb7a655e92f248a4f392fb158f12c..167c976554fa62cf09f50c703d6eaa96240d216e 100644 (file)
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -30,6 +30,7 @@ struct ipv6_devconf {
 #endif
        __s32           max_addresses;
        __s32           accept_ra_defrtr;
+       __s32           accept_ra_min_hop_limit;
        __s32           accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        __s32           accept_ra_rtr_pref;

diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 593b0e32d956c931d667405c200767a122b43bd7..25955206757a5188ad6a9ff48ecae3d9d4de03d3 100644 (file)
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -163,6 +163,8 @@ enum {
        DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL,
        DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
        DEVCONF_SUPPRESS_FRAG_NDISC,
+       DEVCONF_USE_OIF_ADDRS_ONLY,
+       DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
        DEVCONF_MAX
 };
 

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 38540a3ed92f66a7a7ee0f8db2895fb5c06f222a..6c629ffb87564527266f83a81eb37ad23730bda4 100644 (file)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -192,6 +192,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 #endif
        .max_addresses          = IPV6_MAX_ADDRESSES,
        .accept_ra_defrtr       = 1,
+       .accept_ra_min_hop_limit= 1,
        .accept_ra_pinfo        = 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
        .accept_ra_rtr_pref     = 1,
@@ -230,6 +231,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 #endif
        .max_addresses          = IPV6_MAX_ADDRESSES,
        .accept_ra_defrtr       = 1,
+       .accept_ra_min_hop_limit= 1,
        .accept_ra_pinfo        = 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
        .accept_ra_rtr_pref     = 1,
@@ -4150,6 +4152,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
        array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
        array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
+       array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
        array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
@@ -4907,6 +4910,13 @@ static struct addrconf_sysctl_table
                        .mode           = 0644,
                        .proc_handler   = proc_dointvec,
                },
+               {
+                       .procname       = "accept_ra_min_hop_limit",
+                       .data           = &ipv6_devconf.accept_ra_min_hop_limit,
+                       .maxlen         = sizeof(int),
+                       .mode           = 0644,
+                       .proc_handler   = proc_dointvec,
+               },
                {
                        .procname       = "accept_ra_pinfo",
                        .data           = &ipv6_devconf.accept_ra_pinfo,

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index fda5d95e39f4655dfeb95266031be053b3b52c5f..e34a6b3520c64f89f487bc8ed152f15c95784f30 100644 (file)
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1190,18 +1190,16 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
        if (rt)
                rt6_set_expires(rt, jiffies + (HZ * lifetime));
-       if (ra_msg->icmph.icmp6_hop_limit) {
-               /* Only set hop_limit on the interface if it is higher than
-                * the current hop_limit.
-                */
-               if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+       if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
+           ra_msg->icmph.icmp6_hop_limit) {
+               if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
                        in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+                       if (rt)
+                               dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+                                              ra_msg->icmph.icmp6_hop_limit);
                } else {
-                       ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+                       ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
                }
-               if (rt)
-                       dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
-                                      ra_msg->icmph.icmp6_hop_limit);
        }
 
 skip_defrtr: