ipv6: add flowlabel_consistency sysctl
With the introduction of IPV6_FL_F_REFLECT, there is no guarantee of flow label unicity. This patch introduces a new sysctl to protect the old behaviour, enable by default. Changelog of V3: * rename ip6_flowlabel_consistency to flowlabel_consistency * use net_info_ratelimited() * checkpatch cleanups Signed-off-by: Florent Fourcot <florent.fourcot@enst-bretagne.fr> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
46e5f40176
commit
6444f72b4b
|
@ -1118,6 +1118,14 @@ bindv6only - BOOLEAN
|
||||||
|
|
||||||
Default: FALSE (as specified in RFC3493)
|
Default: FALSE (as specified in RFC3493)
|
||||||
|
|
||||||
|
flowlabel_consistency - BOOLEAN
|
||||||
|
Protect the consistency (and unicity) of flow label.
|
||||||
|
You have to disable it to use IPV6_FL_F_REFLECT flag on the
|
||||||
|
flow label manager.
|
||||||
|
TRUE: enabled
|
||||||
|
FALSE: disabled
|
||||||
|
Default: TRUE
|
||||||
|
|
||||||
anycast_src_echo_reply - BOOLEAN
|
anycast_src_echo_reply - BOOLEAN
|
||||||
Controls the use of anycast addresses as source addresses for ICMPv6
|
Controls the use of anycast addresses as source addresses for ICMPv6
|
||||||
echo reply
|
echo reply
|
||||||
|
|
|
@ -27,6 +27,7 @@ struct netns_sysctl_ipv6 {
|
||||||
int ip6_rt_gc_elasticity;
|
int ip6_rt_gc_elasticity;
|
||||||
int ip6_rt_mtu_expires;
|
int ip6_rt_mtu_expires;
|
||||||
int ip6_rt_min_advmss;
|
int ip6_rt_min_advmss;
|
||||||
|
int flowlabel_consistency;
|
||||||
int icmpv6_time;
|
int icmpv6_time;
|
||||||
int anycast_src_echo_reply;
|
int anycast_src_echo_reply;
|
||||||
};
|
};
|
||||||
|
|
|
@ -775,6 +775,7 @@ static int __net_init inet6_net_init(struct net *net)
|
||||||
|
|
||||||
net->ipv6.sysctl.bindv6only = 0;
|
net->ipv6.sysctl.bindv6only = 0;
|
||||||
net->ipv6.sysctl.icmpv6_time = 1*HZ;
|
net->ipv6.sysctl.icmpv6_time = 1*HZ;
|
||||||
|
net->ipv6.sysctl.flowlabel_consistency = 1;
|
||||||
atomic_set(&net->ipv6.rt_genid, 0);
|
atomic_set(&net->ipv6.rt_genid, 0);
|
||||||
|
|
||||||
err = ipv6_init_mibs(net);
|
err = ipv6_init_mibs(net);
|
||||||
|
|
|
@ -588,8 +588,15 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
|
||||||
|
|
||||||
case IPV6_FL_A_GET:
|
case IPV6_FL_A_GET:
|
||||||
if (freq.flr_flags & IPV6_FL_F_REFLECT) {
|
if (freq.flr_flags & IPV6_FL_F_REFLECT) {
|
||||||
|
struct net *net = sock_net(sk);
|
||||||
|
if (net->ipv6.sysctl.flowlabel_consistency) {
|
||||||
|
net_info_ratelimited("Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable\n");
|
||||||
|
return -EPERM;
|
||||||
|
}
|
||||||
|
|
||||||
if (sk->sk_protocol != IPPROTO_TCP)
|
if (sk->sk_protocol != IPPROTO_TCP)
|
||||||
return -ENOPROTOOPT;
|
return -ENOPROTOOPT;
|
||||||
|
|
||||||
np->repflow = 1;
|
np->repflow = 1;
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -31,6 +31,13 @@ static struct ctl_table ipv6_table_template[] = {
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
.procname = "flowlabel_consistency",
|
||||||
|
.data = &init_net.ipv6.sysctl.flowlabel_consistency,
|
||||||
|
.maxlen = sizeof(int),
|
||||||
|
.mode = 0644,
|
||||||
|
.proc_handler = proc_dointvec
|
||||||
|
},
|
||||||
{ }
|
{ }
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -59,6 +66,7 @@ static int __net_init ipv6_sysctl_net_init(struct net *net)
|
||||||
goto out;
|
goto out;
|
||||||
ipv6_table[0].data = &net->ipv6.sysctl.bindv6only;
|
ipv6_table[0].data = &net->ipv6.sysctl.bindv6only;
|
||||||
ipv6_table[1].data = &net->ipv6.sysctl.anycast_src_echo_reply;
|
ipv6_table[1].data = &net->ipv6.sysctl.anycast_src_echo_reply;
|
||||||
|
ipv6_table[2].data = &net->ipv6.sysctl.flowlabel_consistency;
|
||||||
|
|
||||||
ipv6_route_table = ipv6_route_sysctl_init(net);
|
ipv6_route_table = ipv6_route_sysctl_init(net);
|
||||||
if (!ipv6_route_table)
|
if (!ipv6_route_table)
|
||||||
|
|
Loading…
Reference in New Issue