Commit d9333196 authored by Ben Greear's avatar Ben Greear Committed by David S. Miller

ipv6: Allow accepting RA from local IP addresses.

This can be used in virtual networking applications, and
may have other uses as well.  The option is disabled by
default.

A specific use case is setting up virtual routers, bridges, and
hosts on a single OS without the use of network namespaces or
virtual machines.  With proper use of ip rules, routing tables,
veth interface pairs and/or other virtual interfaces,
and applications that can bind to interfaces and/or IP addresses,
it is possibly to create one or more virtual routers with multiple
hosts attached.  The host interfaces can act as IPv6 systems,
with radvd running on the ports in the virtual routers.  With the
option provided in this patch enabled, those hosts can now properly
obtain IPv6 addresses from the radvd.
Signed-off-by: default avatarBen Greear <greearb@candelatech.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f2a762d8
...@@ -1210,6 +1210,18 @@ accept_ra_defrtr - BOOLEAN ...@@ -1210,6 +1210,18 @@ accept_ra_defrtr - BOOLEAN
Functional default: enabled if accept_ra is enabled. Functional default: enabled if accept_ra is enabled.
disabled if accept_ra is disabled. disabled if accept_ra is disabled.
accept_ra_from_local - BOOLEAN
Accept RA with source-address that is found on local machine
if the RA is otherwise proper and able to be accepted.
Default is to NOT accept these as it may be an un-intended
network loop.
Functional default:
enabled if accept_ra_from_local is enabled
on a specific interface.
disabled if accept_ra_from_local is disabled
on a specific interface.
accept_ra_pinfo - BOOLEAN accept_ra_pinfo - BOOLEAN
Learn Prefix Information in Router Advertisement. Learn Prefix Information in Router Advertisement.
......
...@@ -39,6 +39,7 @@ struct ipv6_devconf { ...@@ -39,6 +39,7 @@ struct ipv6_devconf {
#endif #endif
__s32 proxy_ndp; __s32 proxy_ndp;
__s32 accept_source_route; __s32 accept_source_route;
__s32 accept_ra_from_local;
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
__s32 optimistic_dad; __s32 optimistic_dad;
#endif #endif
......
...@@ -163,6 +163,7 @@ enum { ...@@ -163,6 +163,7 @@ enum {
DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL, DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL,
DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL, DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
DEVCONF_SUPPRESS_FRAG_NDISC, DEVCONF_SUPPRESS_FRAG_NDISC,
DEVCONF_ACCEPT_RA_FROM_LOCAL,
DEVCONF_MAX DEVCONF_MAX
}; };
......
...@@ -568,6 +568,7 @@ enum { ...@@ -568,6 +568,7 @@ enum {
NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22, NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
NET_IPV6_PROXY_NDP=23, NET_IPV6_PROXY_NDP=23,
NET_IPV6_ACCEPT_SOURCE_ROUTE=25, NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,
__NET_IPV6_MAX __NET_IPV6_MAX
}; };
......
...@@ -522,6 +522,7 @@ static const struct bin_table bin_net_ipv6_conf_var_table[] = { ...@@ -522,6 +522,7 @@ static const struct bin_table bin_net_ipv6_conf_var_table[] = {
{ CTL_INT, NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN, "accept_ra_rt_info_max_plen" }, { CTL_INT, NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN, "accept_ra_rt_info_max_plen" },
{ CTL_INT, NET_IPV6_PROXY_NDP, "proxy_ndp" }, { CTL_INT, NET_IPV6_PROXY_NDP, "proxy_ndp" },
{ CTL_INT, NET_IPV6_ACCEPT_SOURCE_ROUTE, "accept_source_route" }, { CTL_INT, NET_IPV6_ACCEPT_SOURCE_ROUTE, "accept_source_route" },
{ CTL_INT, NET_IPV6_ACCEPT_RA_FROM_LOCAL, "accept_ra_from_local" },
{} {}
}; };
......
...@@ -186,6 +186,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { ...@@ -186,6 +186,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
.max_desync_factor = MAX_DESYNC_FACTOR, .max_desync_factor = MAX_DESYNC_FACTOR,
.max_addresses = IPV6_MAX_ADDRESSES, .max_addresses = IPV6_MAX_ADDRESSES,
.accept_ra_defrtr = 1, .accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
.accept_ra_pinfo = 1, .accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF #ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1, .accept_ra_rtr_pref = 1,
...@@ -222,6 +223,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = { ...@@ -222,6 +223,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
.max_desync_factor = MAX_DESYNC_FACTOR, .max_desync_factor = MAX_DESYNC_FACTOR,
.max_addresses = IPV6_MAX_ADDRESSES, .max_addresses = IPV6_MAX_ADDRESSES,
.accept_ra_defrtr = 1, .accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
.accept_ra_pinfo = 1, .accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF #ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1, .accept_ra_rtr_pref = 1,
...@@ -4321,6 +4323,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, ...@@ -4321,6 +4323,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao; array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify; array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc; array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc;
array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
} }
static inline size_t inet6_ifla6_size(void) static inline size_t inet6_ifla6_size(void)
...@@ -5167,6 +5170,13 @@ static struct addrconf_sysctl_table ...@@ -5167,6 +5170,13 @@ static struct addrconf_sysctl_table
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec .proc_handler = proc_dointvec
}, },
{
.procname = "accept_ra_from_local",
.data = &ipv6_devconf.accept_ra_from_local,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{ {
/* sentinel */ /* sentinel */
} }
......
...@@ -1148,11 +1148,15 @@ static void ndisc_router_discovery(struct sk_buff *skb) ...@@ -1148,11 +1148,15 @@ static void ndisc_router_discovery(struct sk_buff *skb)
goto skip_defrtr; goto skip_defrtr;
} }
if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, /* Do not accept RA with source-addr found on local machine unless
NULL, 0)) { * accept_ra_from_local is set to true.
*/
if (!(in6_dev->cnf.accept_ra_from_local ||
ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
NULL, 0))) {
ND_PRINTK(2, info, ND_PRINTK(2, info,
"RA: %s, chk_addr failed for dev: %s\n", "RA from local address detected on dev: %s: default router ignored\n",
__func__, skb->dev->name); skb->dev->name);
goto skip_defrtr; goto skip_defrtr;
} }
...@@ -1290,11 +1294,12 @@ static void ndisc_router_discovery(struct sk_buff *skb) ...@@ -1290,11 +1294,12 @@ static void ndisc_router_discovery(struct sk_buff *skb)
} }
#ifdef CONFIG_IPV6_ROUTE_INFO #ifdef CONFIG_IPV6_ROUTE_INFO
if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, if (!(in6_dev->cnf.accept_ra_from_local ||
NULL, 0)) { ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
NULL, 0))) {
ND_PRINTK(2, info, ND_PRINTK(2, info,
"RA: %s, chk-addr (route info) is false for dev: %s\n", "RA from local address detected on dev: %s: router info ignored.\n",
__func__, skb->dev->name); skb->dev->name);
goto skip_routeinfo; goto skip_routeinfo;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment