Skip to contentSkip to conversation

Patch "net/ipv6: add sysctl option accept_ra_min_hop_limit" has been added to the 3.18-stable tree

PATCH [email protected] 3 participants 4 messages May 18, 2017

Subsystems (4)
Networking Stable branch Documentation IPv4/IPv6
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

net/ipv6: add sysctl option accept_ra_min_hop_limit

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-ipv6-add-sysctl-option-accept_ra_min_hop_limit.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 Mon Sep 17 00:00:00 2001

From: Hangbin Liu <[email protected]>
Date: Thu, 30 Jul 2015 14:28:42 +0800
Subject: net/ipv6: add sysctl option accept_ra_min_hop_limit

From: Hangbin Liu <[email protected]>

commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 upstream.

Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface") disabled accept hop limit from RA if it is smaller than the current hop limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4. Processing Received Router Advertisements
A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time, and Retrans Timer) may contain a value denoting that it is unspecified. In such cases, the parameter should be ignored and the host should continue using whatever value it is already using.

If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum hop limit value they can accept from RA. And set default to 1 to meet RFC standards.

Signed-off-by Hangbin Liu <[email protected]>
Acked-by YOSHIFUJI Hideaki <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Amit Pundir <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 Documentation/networking/ip-sysctl.txt |    8 ++++++++
 include/linux/ipv6.h                   |    1 +
 include/uapi/linux/ipv6.h              |    1 +
 net/ipv6/addrconf.c                    |   10 ++++++++++
 net/ipv6/ndisc.c                       |   16 +++++++---------
 5 files changed, 27 insertions(+), 9 deletions(-)
Documentation/networking/ip-sysctl.txt +8 -0
@@ -1256,6 +1256,14 @@ accept_ra_from_local - BOOLEAN
 	   disabled if accept_ra_from_local is disabled
                on a specific interface.
 
+accept_ra_min_hop_limit - INTEGER
+	Minimum hop limit Information in Router Advertisement.
+
+	Hop limit Information in Router Advertisement less than this
+	variable shall be ignored.
+
+	Default: 1
+
 accept_ra_pinfo - BOOLEAN
 	Learn Prefix Information in Router Advertisement.
include/linux/ipv6.h +1 -0
@@ -29,6 +29,7 @@ struct ipv6_devconf {
 	__s32		max_desync_factor;
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
+	__s32		accept_ra_min_hop_limit;
 	__s32		accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	__s32		accept_ra_rtr_pref;
include/uapi/linux/ipv6.h +1 -0
@@ -164,6 +164,7 @@ enum {
 	DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
 	DEVCONF_SUPPRESS_FRAG_NDISC,
 	DEVCONF_ACCEPT_RA_FROM_LOCAL,
+	DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
 	DEVCONF_MAX
 };
net/ipv6/addrconf.c +10 -0
@@ -188,6 +188,7 @@ static struct ipv6_devconf ipv6_devconf
 	.max_addresses		= IPV6_MAX_ADDRESSES,
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
+	.accept_ra_min_hop_limit= 1,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,

@@ -225,6 +226,7 @@ static struct ipv6_devconf ipv6_devconf_
 	.max_addresses		= IPV6_MAX_ADDRESSES,
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
+	.accept_ra_min_hop_limit= 1,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,

@@ -4321,6 +4323,7 @@ static inline void ipv6_store_devconf(st
 	array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
 	array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
 	array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
+	array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
 	array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;

@@ -5135,6 +5138,13 @@ static struct addrconf_sysctl_table
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
 			.proc_handler	= proc_dointvec,
+		},
+		{
+			.procname	= "accept_ra_min_hop_limit",
+			.data		= &ipv6_devconf.accept_ra_min_hop_limit,
+			.maxlen		= sizeof(int),
+			.mode		= 0644,
+			.proc_handler	= proc_dointvec,
 		},
 		{
 			.procname	= "accept_ra_pinfo",
net/ipv6/ndisc.c +7 -9
@@ -1214,18 +1214,16 @@ static void ndisc_router_discovery(struc
 
 	if (rt)
 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
-	if (ra_msg->icmph.icmp6_hop_limit) {
-		/* Only set hop_limit on the interface if it is higher than
-		 * the current hop_limit.
-		 */
-		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
+	    ra_msg->icmph.icmp6_hop_limit) {
+		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
 			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+			if (rt)
+				dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+					       ra_msg->icmph.icmp6_hop_limit);
 		} else {
-			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
 		}
-		if (rt)
-			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
-				       ra_msg->icmph.icmp6_hop_limit);
 	}
 
 skip_defrtr:

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/net-ipv6-add-sysctl-option-accept_ra_min_hop_limit.patch

#1 lore raw

Hi,

2017-05-18 21:22 GMT+09:00 <[email protected]>:

Quoted 86 lines

This is a note to let you know that I've just added the patch titled

net/ipv6: add sysctl option accept_ra_min_hop_limit

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-ipv6-add-sysctl-option-accept_ra_min_hop_limit.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 Mon Sep 17 00:00:00 2001
From: Hangbin Liu <[email protected]>
Date: Thu, 30 Jul 2015 14:28:42 +0800
Subject: net/ipv6: add sysctl option accept_ra_min_hop_limit

From: Hangbin Liu <[email protected]>

commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 upstream.

Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface") disabled accept hop limit from RA if it is smaller than the current hop limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4. Processing Received Router Advertisements
A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time, and Retrans Timer) may contain a value denoting that it is unspecified. In such cases, the parameter should be ignored and the host should continue using whatever value it is already using.

If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum hop limit value they can accept from RA. And set default to 1 to meet RFC standards.

Signed-off-by Hangbin Liu <[email protected]>
Acked-by YOSHIFUJI Hideaki <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Amit Pundir <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 Documentation/networking/ip-sysctl.txt |    8 ++++++++
 include/linux/ipv6.h                   |    1 +
 include/uapi/linux/ipv6.h              |    1 +
 net/ipv6/addrconf.c                    |   10 ++++++++++
 net/ipv6/ndisc.c                       |   16 +++++++---------
 5 files changed, 27 insertions(+), 9 deletions(-)
Documentation/networking/ip-sysctl.txt +8 -0
@@ -1256,6 +1256,14 @@ accept_ra_from_local - BOOLEAN
           disabled if accept_ra_from_local is disabled
                on a specific interface.
 
+accept_ra_min_hop_limit - INTEGER
+       Minimum hop limit Information in Router Advertisement.
+
+       Hop limit Information in Router Advertisement less than this
+       variable shall be ignored.
+
+       Default: 1
+
 accept_ra_pinfo - BOOLEAN
        Learn Prefix Information in Router Advertisement.
include/linux/ipv6.h +1 -0
@@ -29,6 +29,7 @@ struct ipv6_devconf {
        __s32           max_desync_factor;
        __s32           max_addresses;
        __s32           accept_ra_defrtr;
+       __s32           accept_ra_min_hop_limit;
        __s32           accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        __s32           accept_ra_rtr_pref;

include/uapi/linux/ipv6.h enum { · line 170

Quoted 7 lines
include/uapi/linux/ipv6.h +1 -0
@@ -164,6 +164,7 @@ enum {
        DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
        DEVCONF_SUPPRESS_FRAG_NDISC,
        DEVCONF_ACCEPT_RA_FROM_LOCAL,
+       DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
        DEVCONF_MAX
 };

Please do not do this. This is not compatible with current linus-tree.

Quoted 1 line

From Linux 4.11:

DEVCONF_SUPPRESS_FRAG_NDISC,
DEVCONF_ACCEPT_RA_FROM_LOCAL,
DEVCONF_USE_OPTIMISTIC,
DEVCONF_ACCEPT_RA_MTU,
DEVCONF_STABLE_SECRET,
DEVCONF_USE_OIF_ADDRS_ONLY,
DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,
// snip

--yoshfuji

author maintainer
#2 lore raw
Quoted 101 lines · 吉藤英明

Hi,

2017-05-18 21:22 GMT+09:00 <[email protected]>:

Quoted 86 lines

This is a note to let you know that I've just added the patch titled

net/ipv6: add sysctl option accept_ra_min_hop_limit

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-ipv6-add-sysctl-option-accept_ra_min_hop_limit.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 Mon Sep 17 00:00:00 2001
From: Hangbin Liu <[email protected]>
Date: Thu, 30 Jul 2015 14:28:42 +0800
Subject: net/ipv6: add sysctl option accept_ra_min_hop_limit

From: Hangbin Liu <[email protected]>

commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 upstream.

Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface") disabled accept hop limit from RA if it is smaller than the current hop limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4. Processing Received Router Advertisements
A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time, and Retrans Timer) may contain a value denoting that it is unspecified. In such cases, the parameter should be ignored and the host should continue using whatever value it is already using.

If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum hop limit value they can accept from RA. And set default to 1 to meet RFC standards.

Signed-off-by Hangbin Liu <[email protected]>
Acked-by YOSHIFUJI Hideaki <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Amit Pundir <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 Documentation/networking/ip-sysctl.txt |    8 ++++++++
 include/linux/ipv6.h                   |    1 +
 include/uapi/linux/ipv6.h              |    1 +
 net/ipv6/addrconf.c                    |   10 ++++++++++
 net/ipv6/ndisc.c                       |   16 +++++++---------
 5 files changed, 27 insertions(+), 9 deletions(-)
Documentation/networking/ip-sysctl.txt +8 -0
@@ -1256,6 +1256,14 @@ accept_ra_from_local - BOOLEAN
           disabled if accept_ra_from_local is disabled
                on a specific interface.
 
+accept_ra_min_hop_limit - INTEGER
+       Minimum hop limit Information in Router Advertisement.
+
+       Hop limit Information in Router Advertisement less than this
+       variable shall be ignored.
+
+       Default: 1
+
 accept_ra_pinfo - BOOLEAN
        Learn Prefix Information in Router Advertisement.
include/linux/ipv6.h +1 -0
@@ -29,6 +29,7 @@ struct ipv6_devconf {
        __s32           max_desync_factor;
        __s32           max_addresses;
        __s32           accept_ra_defrtr;
+       __s32           accept_ra_min_hop_limit;
        __s32           accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        __s32           accept_ra_rtr_pref;

include/uapi/linux/ipv6.h enum { · line 170

Quoted 7 lines
include/uapi/linux/ipv6.h +1 -0
@@ -164,6 +164,7 @@ enum {
        DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
        DEVCONF_SUPPRESS_FRAG_NDISC,
        DEVCONF_ACCEPT_RA_FROM_LOCAL,
+       DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
        DEVCONF_MAX
 };

Please do not do this. This is not compatible with current linus-tree.

Quoted 1 line

From Linux 4.11:

Quoted 8 lines

DEVCONF_SUPPRESS_FRAG_NDISC,
DEVCONF_ACCEPT_RA_FROM_LOCAL,
DEVCONF_USE_OPTIMISTIC,
DEVCONF_ACCEPT_RA_MTU,
DEVCONF_STABLE_SECRET,
DEVCONF_USE_OIF_ADDRS_ONLY,
DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,

Oh, nice catch. I'll go drop this.

Amit, can you send the _correct_ patch? Looks like Google messed up on their backport :)

thanks,

greg k-h

#3 lore raw
Quoted 111 lines · Greg KH
Quoted 101 lines · 吉藤英明

Hi,

2017-05-18 21:22 GMT+09:00 <[email protected]>:

Quoted 86 lines

This is a note to let you know that I've just added the patch titled

net/ipv6: add sysctl option accept_ra_min_hop_limit

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-ipv6-add-sysctl-option-accept_ra_min_hop_limit.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 Mon Sep 17 00:00:00 2001
From: Hangbin Liu <[email protected]>
Date: Thu, 30 Jul 2015 14:28:42 +0800
Subject: net/ipv6: add sysctl option accept_ra_min_hop_limit

From: Hangbin Liu <[email protected]>

commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 upstream.

Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface") disabled accept hop limit from RA if it is smaller than the current hop limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4. Processing Received Router Advertisements
A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time, and Retrans Timer) may contain a value denoting that it is unspecified. In such cases, the parameter should be ignored and the host should continue using whatever value it is already using.

If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum hop limit value they can accept from RA. And set default to 1 to meet RFC standards.

Signed-off-by Hangbin Liu <[email protected]>
Acked-by YOSHIFUJI Hideaki <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Amit Pundir <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 Documentation/networking/ip-sysctl.txt |    8 ++++++++
 include/linux/ipv6.h                   |    1 +
 include/uapi/linux/ipv6.h              |    1 +
 net/ipv6/addrconf.c                    |   10 ++++++++++
 net/ipv6/ndisc.c                       |   16 +++++++---------
 5 files changed, 27 insertions(+), 9 deletions(-)
Documentation/networking/ip-sysctl.txt +8 -0
@@ -1256,6 +1256,14 @@ accept_ra_from_local - BOOLEAN
           disabled if accept_ra_from_local is disabled
                on a specific interface.
 
+accept_ra_min_hop_limit - INTEGER
+       Minimum hop limit Information in Router Advertisement.
+
+       Hop limit Information in Router Advertisement less than this
+       variable shall be ignored.
+
+       Default: 1
+
 accept_ra_pinfo - BOOLEAN
        Learn Prefix Information in Router Advertisement.
include/linux/ipv6.h +1 -0
@@ -29,6 +29,7 @@ struct ipv6_devconf {
        __s32           max_desync_factor;
        __s32           max_addresses;
        __s32           accept_ra_defrtr;
+       __s32           accept_ra_min_hop_limit;
        __s32           accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        __s32           accept_ra_rtr_pref;

include/uapi/linux/ipv6.h enum { · line 170

Quoted 7 lines
include/uapi/linux/ipv6.h +1 -0
@@ -164,6 +164,7 @@ enum {
        DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
        DEVCONF_SUPPRESS_FRAG_NDISC,
        DEVCONF_ACCEPT_RA_FROM_LOCAL,
+       DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
        DEVCONF_MAX
 };

Please do not do this. This is not compatible with current linus-tree.

Quoted 1 line

From Linux 4.11:

Quoted 8 lines

DEVCONF_SUPPRESS_FRAG_NDISC,
DEVCONF_ACCEPT_RA_FROM_LOCAL,
DEVCONF_USE_OPTIMISTIC,
DEVCONF_ACCEPT_RA_MTU,
DEVCONF_STABLE_SECRET,
DEVCONF_USE_OIF_ADDRS_ONLY,
DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,

Quoted 4 lines

Oh, nice catch. I'll go drop this.

Amit, can you send the _correct_ patch? Looks like Google messed up on their backport :)

Hi,

Thanks for catching this. Please drop this one. This is not an AOSP backport, I just didn't think this one through.

Regards,
Amit Pundir

Quoted 4 lines

thanks,

greg k-h