From patchwork Mon Jan 13 17:22:44 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: FX Le Bail X-Patchwork-Id: 310269 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E09852C0078 for ; Tue, 14 Jan 2014 04:41:46 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753093AbaAMRln (ORCPT ); Mon, 13 Jan 2014 12:41:43 -0500 Received: from smtp06.smtpout.orange.fr ([80.12.242.128]:51932 "EHLO smtp.smtpout.orange.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752581AbaAMRlm (ORCPT ); Mon, 13 Jan 2014 12:41:42 -0500 Received: from localhost.localdomain ([86.214.30.166]) by mwinf5d29 with ME id DVhc1n00d3b2xSm03VhgbQ; Mon, 13 Jan 2014 18:41:40 +0100 From: Francois-Xavier Le Bail To: netdev@vger.kernel.org Cc: Bill Fink , Hannes Frederic Sowa , "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki Yoshifuji , Patrick McHardy , Francois-Xavier Le Bail Subject: [PATCH net-next] IPv6: add option to use anycast addresses as source addresses in icmp error messages Date: Mon, 13 Jan 2014 18:22:44 +0100 Message-Id: <1389633764-5210-1-git-send-email-fx.lebail@yahoo.com> X-Mailer: git-send-email 1.7.10.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org - Add "anycast_src_icmp_error" sysctl to control the use of anycast addresses as source addresses for ICMPv6 error messages. This sysctl is false by default to preserve existing behavior. - Use it in icmp6_send(). Suggested-by: Bill Fink Signed-off-by: Francois-Xavier Le Bail --- This change allows to follow a recommandation of RFC4942. RFC4942 - IPv6 Transition/Coexistence Security Considerations (http://tools.ietf.org/html/rfc4942#section-2.1.6) 2.1.6. Anycast Traffic Identification and Security [...] To avoid exposing knowledge about the internal structure of the network, it is recommended that anycast servers now take advantage of the ability to return responses with the anycast address as the source address if possible. include/net/netns/ipv6.h | 1 + net/ipv6/icmp.c | 4 +++- net/ipv6/sysctl_net_ipv6.c | 8 ++++++++ 3 files changed, 12 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h index 592fecd..75abbbe 100644 --- a/include/net/netns/ipv6.h +++ b/include/net/netns/ipv6.h @@ -29,6 +29,7 @@ struct netns_sysctl_ipv6 { int ip6_rt_min_advmss; int icmpv6_time; int anycast_src_echo_reply; + int anycast_src_icmp_error; }; struct netns_ipv6 { diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index 13640f2..410aa32 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -412,7 +412,9 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info) */ addr_type = ipv6_addr_type(&hdr->daddr); - if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0)) + if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) || + (net->ipv6.sysctl.anycast_src_icmp_error && + ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))) saddr = &hdr->daddr; /* diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c index b51b268..5f6d5bb 100644 --- a/net/ipv6/sysctl_net_ipv6.c +++ b/net/ipv6/sysctl_net_ipv6.c @@ -31,6 +31,13 @@ static struct ctl_table ipv6_table_template[] = { .mode = 0644, .proc_handler = proc_dointvec }, + { + .procname = "anycast_src_icmp_error", + .data = &init_net.ipv6.sysctl.anycast_src_icmp_error, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec + }, { } }; @@ -59,6 +66,7 @@ static int __net_init ipv6_sysctl_net_init(struct net *net) goto out; ipv6_table[0].data = &net->ipv6.sysctl.bindv6only; ipv6_table[1].data = &net->ipv6.sysctl.anycast_src_echo_reply; + ipv6_table[2].data = &net->ipv6.sysctl.anycast_src_icmp_error; ipv6_route_table = ipv6_route_sysctl_init(net); if (!ipv6_route_table)