| Message ID | 3635f139e31e1c28803ed6d76743c8d8da2c2d3d.1522166051.git.lorenzo.bianconi@redhat.com |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | do not allow to add routes if disable_ipv6 is enabled | expand |
On 3/27/18 11:11 AM, Lorenzo Bianconi wrote: > Do not allow to set ipv6 routes from userspace if disable_ipv6 has been > enabled. The issue can be triggered using the following reproducer: > > - sysctl net.ipv6.conf.all.disable_ipv6=1 > - ip -6 route add a:b:c:d::/64 dev em1 > - ip -6 route show > a:b:c:d::/64 dev em1 metric 1024 pref medium > > Fix it checking disable_ipv6 value in ip6_route_info_create routine > > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > --- > net/ipv6/route.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index 1d0eaa69874d..672fd7fdb037 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -2917,6 +2917,11 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, > if (!dev) > goto out; > > + if (idev->cnf.disable_ipv6) { > + err = -EACCES; you need an extack message telling the user that IPv6 is disabled on the nexthop device. > + goto out; > + } > + > if (!(dev->flags & IFF_UP)) { > NL_SET_ERR_MSG(extack, "Nexthop device is not up"); > err = -ENETDOWN; >
> On 3/27/18 11:11 AM, Lorenzo Bianconi wrote: > > Do not allow to set ipv6 routes from userspace if disable_ipv6 has been > > enabled. The issue can be triggered using the following reproducer: > > > > - sysctl net.ipv6.conf.all.disable_ipv6=1 > > - ip -6 route add a:b:c:d::/64 dev em1 > > - ip -6 route show > > a:b:c:d::/64 dev em1 metric 1024 pref medium > > > > Fix it checking disable_ipv6 value in ip6_route_info_create routine > > > > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> > > --- > > net/ipv6/route.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > > index 1d0eaa69874d..672fd7fdb037 100644 > > --- a/net/ipv6/route.c > > +++ b/net/ipv6/route.c > > @@ -2917,6 +2917,11 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, > > if (!dev) > > goto out; > > > > + if (idev->cnf.disable_ipv6) { > > + err = -EACCES; > > you need an extack message telling the user that IPv6 is disabled on the > nexthop device. > Ack, will do in v2. Regards, Lorenzo > > + goto out; > > + } > > + > > if (!(dev->flags & IFF_UP)) { > > NL_SET_ERR_MSG(extack, "Nexthop device is not up"); > > err = -ENETDOWN; > > >
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 1d0eaa69874d..672fd7fdb037 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2917,6 +2917,11 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, if (!dev) goto out; + if (idev->cnf.disable_ipv6) { + err = -EACCES; + goto out; + } + if (!(dev->flags & IFF_UP)) { NL_SET_ERR_MSG(extack, "Nexthop device is not up"); err = -ENETDOWN;
Do not allow to set ipv6 routes from userspace if disable_ipv6 has been enabled. The issue can be triggered using the following reproducer: - sysctl net.ipv6.conf.all.disable_ipv6=1 - ip -6 route add a:b:c:d::/64 dev em1 - ip -6 route show a:b:c:d::/64 dev em1 metric 1024 pref medium Fix it checking disable_ipv6 value in ip6_route_info_create routine Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> --- net/ipv6/route.c | 5 +++++ 1 file changed, 5 insertions(+)