| Message ID | 1389633764-5210-1-git-send-email-fx.lebail@yahoo.com |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
On Mon, Jan 13, 2014 at 06:22:44PM +0100, Francois-Xavier Le Bail wrote: > - Add "anycast_src_icmp_error" sysctl to control the use of anycast addresses > as source addresses for ICMPv6 error messages. This sysctl is false by > default to preserve existing behavior. > - Use it in icmp6_send(). > > Suggested-by: Bill Fink <billfink@mindspring.com> > Signed-off-by: Francois-Xavier Le Bail <fx.lebail@yahoo.com> Regarding the anycast patches, I contacted someone from IETF. The number of sysctls needed to get introduced to have all the flexibility regarding source address selection and don't break backward compatibility concerns me a bit. Especially on end hosts, where those switches will be important, I think we really have to think about sensible defaults without breaking current software. I currently consider a per-address flag, if those anycast addresses should be available in source address selection (also with an enhancement to current IPV6_JOIN_ANYCAST logic). Greetings, Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, Jan 14, 2014 at 02:13:44PM +0100, Hannes Frederic Sowa wrote: > On Mon, Jan 13, 2014 at 06:22:44PM +0100, Francois-Xavier Le Bail wrote: > > - Add "anycast_src_icmp_error" sysctl to control the use of anycast addresses > > as source addresses for ICMPv6 error messages. This sysctl is false by > > default to preserve existing behavior. > > - Use it in icmp6_send(). > > > > Suggested-by: Bill Fink <billfink@mindspring.com> > > Signed-off-by: Francois-Xavier Le Bail <fx.lebail@yahoo.com> > > Regarding the anycast patches, I contacted someone from IETF. > > The number of sysctls needed to get introduced to have all the flexibility > regarding source address selection and don't break backward compatibility > concerns me a bit. > > Especially on end hosts, where those switches will be important, I think we > really have to think about sensible defaults without breaking current > software. > > I currently consider a per-address flag, if those anycast addresses > should be available in source address selection (also with an enhancement to > current IPV6_JOIN_ANYCAST logic). Francois, we should really think about this. Also if we should just make the pre-defined subnet address just a normal anycast address in the long-term (which just happens to get automatically added to an interface if forwarding is enabled) and bundle all the source address selection logic on the per-address state. If that would be the case, we could revert 509aba3b0d366b7f16a9a2eebac1156b25f5f622 ("IPv6: add the option to use anycast addresses as source addresses in echo reply") and thus would eliminate one sysctl. It would be fine if we can make this decision before David merges with Linus. I guess we can still do this decision while in -rc phase. But as soon as the knob is in a released version of linux we can never take it back (I really don't like sysctls). Greetings, Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h index 592fecd..75abbbe 100644 --- a/include/net/netns/ipv6.h +++ b/include/net/netns/ipv6.h @@ -29,6 +29,7 @@ struct netns_sysctl_ipv6 { int ip6_rt_min_advmss; int icmpv6_time; int anycast_src_echo_reply; + int anycast_src_icmp_error; }; struct netns_ipv6 { diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index 13640f2..410aa32 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -412,7 +412,9 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info) */ addr_type = ipv6_addr_type(&hdr->daddr); - if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0)) + if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) || + (net->ipv6.sysctl.anycast_src_icmp_error && + ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))) saddr = &hdr->daddr; /* diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c index b51b268..5f6d5bb 100644 --- a/net/ipv6/sysctl_net_ipv6.c +++ b/net/ipv6/sysctl_net_ipv6.c @@ -31,6 +31,13 @@ static struct ctl_table ipv6_table_template[] = { .mode = 0644, .proc_handler = proc_dointvec }, + { + .procname = "anycast_src_icmp_error", + .data = &init_net.ipv6.sysctl.anycast_src_icmp_error, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec + }, { } }; @@ -59,6 +66,7 @@ static int __net_init ipv6_sysctl_net_init(struct net *net) goto out; ipv6_table[0].data = &net->ipv6.sysctl.bindv6only; ipv6_table[1].data = &net->ipv6.sysctl.anycast_src_echo_reply; + ipv6_table[2].data = &net->ipv6.sysctl.anycast_src_icmp_error; ipv6_route_table = ipv6_route_sysctl_init(net); if (!ipv6_route_table)
- Add "anycast_src_icmp_error" sysctl to control the use of anycast addresses as source addresses for ICMPv6 error messages. This sysctl is false by default to preserve existing behavior. - Use it in icmp6_send(). Suggested-by: Bill Fink <billfink@mindspring.com> Signed-off-by: Francois-Xavier Le Bail <fx.lebail@yahoo.com> --- This change allows to follow a recommandation of RFC4942. RFC4942 - IPv6 Transition/Coexistence Security Considerations (http://tools.ietf.org/html/rfc4942#section-2.1.6) 2.1.6. Anycast Traffic Identification and Security [...] To avoid exposing knowledge about the internal structure of the network, it is recommended that anycast servers now take advantage of the ability to return responses with the anycast address as the source address if possible. include/net/netns/ipv6.h | 1 + net/ipv6/icmp.c | 4 +++- net/ipv6/sysctl_net_ipv6.c | 8 ++++++++ 3 files changed, 12 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html